Skip to content
Snippets Groups Projects
  1. Mar 03, 2022
  2. Jan 27, 2022
  3. Jul 09, 2021
  4. Oct 22, 2021
  5. Dec 26, 2020
    • Dan Villiom Podlaski Christiansen's avatar
      push & pull: consolidate invalid path handling, default to skipping · b46639f34ff6
      Dan Villiom Podlaski Christiansen authored
      The current behaviour is quite unhelpful, given that it either allows
      you to abort the conversion or generate a bogus repository. As an
      example, GitHub rejects anything with a `.git` in it.
      
      Instead, the new default is to issue a warning and simply discard the
      dangerous files. Although this might cause problems down the line, I'd
      much rather have those problems than just have hg-git give up.
      
      As an example of such a bogus repository, look no further than this
      one. c43c02cc803a committed some tests from Dulwich with nested Git
      repositories, and a061dce264b7 renamed them. Prior to this change,
      hg-git could not push its own repository to GitHub.
      
      Further more, Mercurial disallows paths containing carriage return
      (CR) and newline (NL) characters; as noted in the original Mercurial
      bug report that enabled this behaviour,[1] such paths appear for
      folder icons on macOS. This was reported on the list by Uwe Brauer.[2]
      
      Since Mercurial simply cannot store these files, we always either skip
      them or abort the conversion.
      
      [1] https://bz.mercurial-scm.org/show_bug.cgi?id=352
      [2] https://groups.google.com/g/hg-git/c/Rz3oRzrMS3Q/m/RRq4AIMsBAAJ
      b46639f34ff6
  6. Dec 22, 2020
  7. Jan 28, 2021
  8. Jan 31, 2021
  9. Jun 12, 2020
  10. Dec 22, 2019
    • Georges Racinet's avatar
      tests: skipping test-illegal-contents on Git >= 2.24 · ed3767c0bc92
      Georges Racinet authored
      Git behaviour and output has changed, in a way that seems
      hard to reconcile with glob or regex patterns.
      
      we'll probably have to write an entire variant of this test.
      In the meanwhile, this skipping should restore the main CI runs.
      ed3767c0bc92
  11. Aug 01, 2019
  12. Feb 04, 2016
  13. Nov 24, 2014
    • durin42's avatar
      hg2git: audit path components during export (CVE-2014-9390) · 81c55f8629ba
      durin42 authored
      A user recently got confused and managed to track and export a .git
      directory, which confuses git and causes it to emit very odd
      errors. For example, cloning one such repository (which has a symlink
      for .git) produces this output from git:
      
        Cloning into 'git'...
        done.
        error: Updating '.git' would lose untracked files in it
      
      and another (which has a .git directory checked in) produces this:
      
        Cloning into 'git'...
        done.
        error: Invalid path '.git/hooks/post-update'
      
      If it ended there, that'd be fine, but this led to a line of
      investigation that ended with CVE-2014-9390, so now git will block
      checking these revisions out, so we should try to prevent
      foot-shooting on our end. Since some servers (notably github) are
      blocking trees that contain these entries, default to refusing to
      export any path component that looks like it folds to .git. Since some
      histories probably contain this already, we offer an escape hatch via
      the config option git.blockdotgit that allows users to resume
      foot-shooting behavior.
      81c55f8629ba
Loading