Skip to content
Snippets Groups Projects
  1. Nov 24, 2014
    • durin42's avatar
      hg2git: audit path components during export (CVE-2014-9390) · 81c55f8629ba
      durin42 authored
      A user recently got confused and managed to track and export a .git
      directory, which confuses git and causes it to emit very odd
      errors. For example, cloning one such repository (which has a symlink
      for .git) produces this output from git:
      
        Cloning into 'git'...
        done.
        error: Updating '.git' would lose untracked files in it
      
      and another (which has a .git directory checked in) produces this:
      
        Cloning into 'git'...
        done.
        error: Invalid path '.git/hooks/post-update'
      
      If it ended there, that'd be fine, but this led to a line of
      investigation that ended with CVE-2014-9390, so now git will block
      checking these revisions out, so we should try to prevent
      foot-shooting on our end. Since some servers (notably github) are
      blocking trees that contain these entries, default to refusing to
      export any path component that looks like it folds to .git. Since some
      histories probably contain this already, we offer an escape hatch via
      the config option git.blockdotgit that allows users to resume
      foot-shooting behavior.
      81c55f8629ba
  2. Dec 29, 2014
  3. Dec 10, 2014
  4. Dec 05, 2014
  5. Dec 02, 2014
    • Siddharth Agarwal's avatar
      git_handler: mark source for rename info as Git or Mercurial · fffe8883960b
      Siddharth Agarwal authored
      See inline comments for why the additional metadata needs to be stored.
      
      This literally breaks all the hashes because of the additional metadata. The
      changing of hashes is unfortunate but necessary to preserve bidirectionality.
      
      While this could be broken up into multiple commits, there was no way to do
      that while preserving bidirectionality. Following the principle that every
      intermediate commit must result in a correct state, I decided to combine the
      commits.
      fffe8883960b
    • Siddharth Agarwal's avatar
      git_handler.get_files_changed: detect renames when asked to do so · da804eac2b00
      Siddharth Agarwal authored
      We use Dulwich's rename detector to detect any renames over the specified
      similarity threshold.
      
      This isn't fully bidirectional yet -- when the commit is exported to Git
      the hashes will no longer be the same. That's why that isn't tested here. In
      upcoming patches we'll make sure it's bidirectional and will add the
      corresponding tests.
      da804eac2b00
  6. Dec 06, 2014
  7. Dec 02, 2014
  8. Dec 05, 2014
  9. Dec 01, 2014
  10. Nov 30, 2014
    • Siddharth Agarwal's avatar
      git_handler.export_git_objects: avoid unnecessary list creation · 799c41a24e75
      Siddharth Agarwal authored
      These are used just once, so generators are fine for them.
      799c41a24e75
    • Siddharth Agarwal's avatar
      git_handler.export_git_objects: filter out octopus explosions earlier · 4b5a18d2fa10
      Siddharth Agarwal authored
      hg-git translates octopus merges into a series of merges, called an octopus
      explosion. The intermediate octopus explosion commits are not recorded in
      the mapfile -- only the final commit is. This means that they show up in the
      export list and have to then be detected and filtered out.
      
      Don't initialize the incremental exporter with octopus explosion commits.
      Previously, if there were octopus merges early in the history, we'd initialize
      the incremental exporter with the first one's parent, then calculate the diff
      of that against the first commit we actually cared about exporting. That's slow
      and wasteful.
      
      For a particular real-world repo with one octopus merge 1/3 of the way in
      history, this is a 10x improvement for 'hg gexport' with one commit to export
      -- 60 seconds to 6.
      4b5a18d2fa10
    • Siddharth Agarwal's avatar
      git_handler: iterate over contexts, not nodes · 5fa9649c4ef6
      Siddharth Agarwal authored
      This prepares for an upcoming patch.
      
      In theory, we could pass the context into export_hg_commit, but there's some
      encoding shenanigans going on there that I don't want to delve into.
      5fa9649c4ef6
  11. Nov 25, 2014
    • Durham Goode's avatar
      manifest: add matches() to overlay · 64fa5ea18b89
      Durham Goode authored
      0cc283f44655 in upstream Mercurial added a matches function to the manifest.
      This broke 'hg incoming -p' with hg-git. This patch adds a simple implementation
      that fixes the problem.
      
      This was caught by the tests, and now the tests pass.
      64fa5ea18b89
  12. Nov 05, 2014
  13. Nov 04, 2014
  14. Oct 30, 2014
  15. Oct 31, 2014
  16. Oct 30, 2014
  17. Oct 31, 2014
  18. Oct 29, 2014
Loading