Skip to content
Snippets Groups Projects
  • Sean Farley's avatar
    475af2f89636
    subrepo: add tests for hg rogue ssh urls (SEC) · 475af2f89636
    Sean Farley authored
    'ssh://' has an exploit that will pass the url blindly to the ssh
    command, allowing a malicious person to have a subrepo with
    '-oProxyCommand' which could run arbitrary code on a user's machine. In
    addition, at least on Windows, a pipe '|' is able to execute arbitrary
    commands.
    
    When this happens, let's throw a big abort into the user's face so that
    they can inspect what's going on.
    475af2f89636
    History
    subrepo: add tests for hg rogue ssh urls (SEC)
    Sean Farley authored
    'ssh://' has an exploit that will pass the url blindly to the ssh
    command, allowing a malicious person to have a subrepo with
    '-oProxyCommand' which could run arbitrary code on a user's machine. In
    addition, at least on Windows, a pipe '|' is able to execute arbitrary
    commands.
    
    When this happens, let's throw a big abort into the user's face so that
    they can inspect what's going on.