Skip to content
Snippets Groups Projects
Commit 0ee42a0d authored by Sean Farley's avatar Sean Farley
Browse files

pull: add tests for unsafe ssh url (SEC)

parent 0bcceb58
Branches
Tags
No related merge requests found
......@@ -105,4 +105,23 @@
$ URL=`$PYTHON -c "import os; print 'file://localhost' + ('/' + os.getcwd().replace(os.sep, '/')).replace('//', '/') + '/../test'"`
$ hg pull -q "$URL"
SEC: check for unsafe ssh url
$ hg pull 'ssh://-oProxyCommand=touch${IFS}owned/path'
pulling from ssh://-oProxyCommand%3Dtouch%24%7BIFS%7Downed/path
abort: potentially unsafe url: 'ssh://-oProxyCommand=touch${IFS}owned/path'
[255]
$ hg pull 'ssh://%2DoProxyCommand=touch${IFS}owned/path'
pulling from ssh://-oProxyCommand%3Dtouch%24%7BIFS%7Downed/path
abort: potentially unsafe url: 'ssh://-oProxyCommand=touch${IFS}owned/path'
[255]
$ hg pull 'ssh://fakehost|shellcommand/path'
pulling from ssh://fakehost%7Cshellcommand/path
abort: potentially unsafe url: 'ssh://fakehost|shellcommand/path'
[255]
$ hg pull 'ssh://fakehost%7Cshellcommand/path'
pulling from ssh://fakehost%7Cshellcommand/path
abort: potentially unsafe url: 'ssh://fakehost|shellcommand/path'
[255]
$ cd ..
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment