Skip to content
Snippets Groups Projects
  1. Sep 20, 2017
  2. Sep 18, 2017
  3. Jul 31, 2017
  4. Sep 15, 2017
  5. Sep 11, 2017
  6. Sep 14, 2017
    • Martin von Zweigbergk's avatar
      repair: preserve phase also when not using generaldelta (issue5678) · 91f0677dc920
      Martin von Zweigbergk authored
      It seems like we used to pick the oldest possible version of the
      changegroup to use for bundles created by the repair module (used
      e.g. by "hg strip" and for temporary bundles by "hg rebase"). I tried
      to preserve that behavior when I created the changegroup.safeversion()
      method in 3b2ac2115464 (changegroup: introduce safeversion(),
      2016-01-19).
      
      However, we have recently chagned our minds and decided that these
      commands are only used locally and downgrades are unlikely. That
      decicion allowed us to start adding obsmarker and phase information to
      these bundles. However, as the bug report shows, it means we get
      different behavior e.g. when generaldelta is not enabled (because when
      it was enabled, it forced us to use bundle2). The commit that actually
      caused the reported bug was 8e3021fd1a44 (strip: include phases in
      bundle (BC), 2017-06-15).
      
      So, since we now depend on having more information in the bundles,
      let's make sure we instead pick the newest possible changegroup
      version.
      
      Differential Revision: https://phab.mercurial-scm.org/D715
      91f0677dc920
    • Martin von Zweigbergk's avatar
      tests: add test for issue5678 · b5d7e7d5c573
      Martin von Zweigbergk authored
      In addition to a test case for the direct problem described in the bug
      report, this also adds a test case showing how obsmarkers can also get
      lost when not using generaldelta.
      
      Differential Revision: https://phab.mercurial-scm.org/D714
      b5d7e7d5c573
  7. Sep 10, 2017
    • kiilerix's avatar
      mq: create non-lossy patches, also with custom global diff configuration · 987a85c42b08
      kiilerix authored
      Users with custom [diff] configuration most certainly didn't intend it to make
      mq lose changes. It could:
      
       * git is handled perfectly fine.
      
       * nobinary could make mq leave some files out from the patches.
      
       * noprefix could make mq itself (and probably also other tools) fail to apply
         patches without the usual a/b prefix.
      
       * ignorews, ignorewsamount, or ignoreblanklines could create patches with
         missing whitespace that could fail to apply correctly.
      
      Thus, when refreshing patches, use patch.difffeatureopts, optionally with git
      as before, but without the config options for whitespace and format changing
      that most likely will cause loss or problems.
      
      (patch.diffopts is just patch.difffeatureopts with all options enabled and can
      be replaced with that.)
      987a85c42b08
    • kiilerix's avatar
  8. Aug 29, 2017
    • Matt Harbison's avatar
      debugssl: allow a URL to be specified without a local repository · 3c3066367d72
      Matt Harbison authored
      This was the original intent, but I bungled the logic.  Otherwise if there is a
      certificate chain issue, the repository can't be cloned in order for there to be
      a repo object.  I think I missed this case because I was inside of a Mercurial
      clone as I was originally developing and testing this.
      3c3066367d72
  9. Aug 27, 2017
  10. Aug 16, 2017
  11. Aug 18, 2017
  12. Aug 15, 2017
    • Gregory Szorc's avatar
      ui: restore behavior to ignore some I/O errors (issue5658) · cde4cfeb6e3e
      Gregory Szorc authored
      e9646ff34d55 and 1bfb9a63b98e refactored ui methods to no longer
      silently swallow some IOError instances. This is arguably the
      correct thing to do. However, it had the unfortunate side-effect
      of causing StdioError to bubble up to sensitive code like
      transaction aborts, leading to an uncaught exceptions and failures
      to e.g. roll back a transaction. This could occur when a remote
      HTTP or SSH client connection dropped. The new behavior is
      resulting in semi-frequent "abandonded transaction" errors on
      multiple high-volume repositories at Mozilla.
      
      This commit effectively reverts e9646ff34d55 and 1bfb9a63b98e to
      restore the old behavior.
      
      I agree with the principle that I/O errors shouldn't be ignored.
      That makes this change... unfortunate. However, our hands are tied
      for what to do on stable. I think the proper solution is for the
      ui's behavior to be configurable (possibly via a context manager).
      During critical sections like transaction rollback and abort, it
      should be possible to suppress errors. But this feature would not
      be appropriate on stable.
      cde4cfeb6e3e
  13. Aug 14, 2017
    • Gregory Szorc's avatar
      tests: test behavior of IOError during transactions (issue5658) · 2debf1e3cfa4
      Gregory Szorc authored
      ui._write(), ui._write_err(), and ui.flush() all trap IOError and
      re-raise as error.StdioError. If a caller doesn't catch StdioError
      when writing to stdio, it could bubble all the way to dispatch.
      
      This commit adds tests for I/O failures around various transaction
      operations.
      
      The most notable badness is during abort. Here, an uncaught StdioError
      will result in incomplete transaction rollback, requiring an
      `hg rollback` to recover. This can result in a client "corrupting"
      a remote repo via terminated HTTP and SSH socket.
      2debf1e3cfa4
  14. Aug 16, 2017
  15. Aug 12, 2017
  16. Aug 11, 2017
  17. Aug 10, 2017
  18. Aug 07, 2017
    • Yuya Nishihara's avatar
      ssh: unban the use of pipe character in user@host:port string · 3fee7f7d2da0
      Yuya Nishihara authored
      This vulnerability was fixed by the previous patch and there were more ways
      to exploit than using '|shellcmd'. So it doesn't make sense to reject only
      pipe character.
      
      Test cases are updated to actually try to exploit the bug. As the SSH bridge
      of git/svn subrepos are not managed by our code, the tests for non-hg subrepos
      are just removed.
      
      This may be folded into the original patches.
      4.3.1
      3fee7f7d2da0
  19. Aug 05, 2017
  20. Jul 31, 2017
    • Sean Farley's avatar
      subrepo: add tests for git rogue ssh urls (SEC) · db83a1df03fe
      Sean Farley authored
      'ssh://' has an exploit that will pass the url blindly to the ssh
      command, allowing a malicious person to have a subrepo with
      '-oProxyCommand' which could run arbitrary code on a user's machine. In
      addition, at least on Windows, a pipe '|' is able to execute arbitrary
      commands.
      
      When this happens, let's throw a big abort into the user's face so that
      they can inspect what's going on.
      db83a1df03fe
    • Sean Farley's avatar
      subrepo: add tests for svn rogue ssh urls (SEC) · 60ee7af2a2ba
      Sean Farley authored
      'ssh://' has an exploit that will pass the url blindly to the ssh
      command, allowing a malicious person to have a subrepo with
      '-oProxyCommand' which could run arbitrary code on a user's machine. In
      addition, at least on Windows, a pipe '|' is able to execute arbitrary
      commands.
      
      When this happens, let's throw a big abort into the user's face so that
      they can inspect what's going on.
      60ee7af2a2ba
    • Sean Farley's avatar
      subrepo: add tests for hg rogue ssh urls (SEC) · 475af2f89636
      Sean Farley authored
      'ssh://' has an exploit that will pass the url blindly to the ssh
      command, allowing a malicious person to have a subrepo with
      '-oProxyCommand' which could run arbitrary code on a user's machine. In
      addition, at least on Windows, a pipe '|' is able to execute arbitrary
      commands.
      
      When this happens, let's throw a big abort into the user's face so that
      they can inspect what's going on.
      475af2f89636
    • Sean Farley's avatar
      push: add tests for unsafe ssh url (SEC) · 48d520fdf880
      Sean Farley authored
      48d520fdf880
  21. Jul 28, 2017
  22. Aug 01, 2017
  23. Aug 04, 2017
  24. Jul 28, 2017
    • Sean Farley's avatar
      util: add utility method to check for bad ssh urls (SEC) · 0b3fe3910ef5
      Sean Farley authored
      Our use of SSH has an exploit that will parse the first part of an url
      blindly as a hostname. Prior to this set of security patches, a url
      with '-oProxyCommand' could run arbitrary code on a user's machine. In
      addition, at least on Windows, a pipe '|' can be abused to execute
      arbitrary commands in a similar fashion.
      
      We defend against this by checking ssh:// URLs and looking for a
      hostname that starts with a - or contains a |.
      
      When this happens, let's throw a big abort into the user's face so
      that they can inspect what's going on.
      0b3fe3910ef5
  25. Jul 26, 2017
    • Yuya Nishihara's avatar
      pathauditor: disable cache of audited paths by default (issue5628) · 377e8ddaebef
      Yuya Nishihara authored
      The initial attempt was to discard cache when appropriate, but it appears
      to be error prone. We had to carefully inspect all places where audit() is
      called e.g. without actually updating filesystem, before removing files and
      directories, etc.
      
      So, this patch disables the cache of audited paths by default, and enables
      it only for the following cases:
      
       - short-lived auditor objects
       - repo.vfs, repo.svfs, and repo.cachevfs, which are managed directories
         and considered sort of append-only (a file/directory would never be
         replaced with a symlink)
      
      There would be more cacheable vfs objects (e.g. mq.queue.opener), but I
      decided not to inspect all of them in this patch. We can make them cached
      later.
      
      Benchmark result:
      
      - using old clone of http://selenic.com/repo/linux-2.6/ (38319 files)
      - on tmpfs
      - run HGRCPATH=/dev/null hg up -q --time tip && hg up -q null
      - try 4 times and take the last three results
      
      original:
      real 7.480 secs (user 1.140+22.760 sys 0.150+1.690)
      real 8.010 secs (user 1.070+22.280 sys 0.170+2.120)
      real 7.470 secs (user 1.120+22.390 sys 0.120+1.910)
      
      clearcache (the other series):
      real 7.680 secs (user 1.120+23.420 sys 0.140+1.970)
      real 7.670 secs (user 1.110+23.620 sys 0.130+1.810)
      real 7.740 secs (user 1.090+23.510 sys 0.160+1.940)
      
      enable cache only for vfs and svfs (this series):
      real 8.730 secs (user 1.500+25.190 sys 0.260+2.260)
      real 8.750 secs (user 1.490+25.170 sys 0.250+2.340)
      real 9.010 secs (user 1.680+25.340 sys 0.280+2.540)
      
      remove cache function at all (for reference):
      real 9.620 secs (user 1.440+27.120 sys 0.250+2.980)
      real 9.420 secs (user 1.400+26.940 sys 0.320+3.130)
      real 9.760 secs (user 1.530+27.270 sys 0.250+2.970)
      377e8ddaebef
  26. Aug 01, 2017
Loading