Skip to content
Snippets Groups Projects
  1. Jan 27, 2022
  2. Jul 09, 2021
  3. Oct 22, 2021
  4. Dec 26, 2020
    • Dan Villiom Podlaski Christiansen's avatar
      push & pull: consolidate invalid path handling, default to skipping · b46639f3
      Dan Villiom Podlaski Christiansen authored
      The current behaviour is quite unhelpful, given that it either allows
      you to abort the conversion or generate a bogus repository. As an
      example, GitHub rejects anything with a `.git` in it.
      
      Instead, the new default is to issue a warning and simply discard the
      dangerous files. Although this might cause problems down the line, I'd
      much rather have those problems than just have hg-git give up.
      
      As an example of such a bogus repository, look no further than this
      one. c43c02cc803a committed some tests from Dulwich with nested Git
      repositories, and a061dce264b7 renamed them. Prior to this change,
      hg-git could not push its own repository to GitHub.
      
      Further more, Mercurial disallows paths containing carriage return
      (CR) and newline (NL) characters; as noted in the original Mercurial
      bug report that enabled this behaviour,[1] such paths appear for
      folder icons on macOS. This was reported on the list by Uwe Brauer.[2]
      
      Since Mercurial simply cannot store these files, we always either skip
      them or abort the conversion.
      
      [1] https://bz.mercurial-scm.org/show_bug.cgi?id=352
      [2] https://groups.google.com/g/hg-git/c/Rz3oRzrMS3Q/m/RRq4AIMsBAAJ
      b46639f3
  5. Dec 22, 2020
  6. Jan 28, 2021
  7. Jan 31, 2021
  8. Jun 12, 2020
  9. Dec 22, 2019
    • Georges Racinet's avatar
      tests: skipping test-illegal-contents on Git >= 2.24 · ed3767c0
      Georges Racinet authored
      Git behaviour and output has changed, in a way that seems
      hard to reconcile with glob or regex patterns.
      
      we'll probably have to write an entire variant of this test.
      In the meanwhile, this skipping should restore the main CI runs.
      ed3767c0
  10. Aug 01, 2019
  11. Feb 04, 2016
  12. Nov 24, 2014
    • durin42's avatar
      hg2git: audit path components during export (CVE-2014-9390) · 81c55f86
      durin42 authored
      A user recently got confused and managed to track and export a .git
      directory, which confuses git and causes it to emit very odd
      errors. For example, cloning one such repository (which has a symlink
      for .git) produces this output from git:
      
        Cloning into 'git'...
        done.
        error: Updating '.git' would lose untracked files in it
      
      and another (which has a .git directory checked in) produces this:
      
        Cloning into 'git'...
        done.
        error: Invalid path '.git/hooks/post-update'
      
      If it ended there, that'd be fine, but this led to a line of
      investigation that ended with CVE-2014-9390, so now git will block
      checking these revisions out, so we should try to prevent
      foot-shooting on our end. Since some servers (notably github) are
      blocking trees that contain these entries, default to refusing to
      export any path component that looks like it folds to .git. Since some
      histories probably contain this already, we offer an escape hatch via
      the config option git.blockdotgit that allows users to resume
      foot-shooting behavior.
      81c55f86
Loading