Skip to content
Snippets Groups Projects
  1. Aug 10, 2017
  2. Aug 07, 2017
    • Yuya Nishihara's avatar
      ssh: unban the use of pipe character in user@host:port string · 3fee7f7d2da0
      Yuya Nishihara authored
      This vulnerability was fixed by the previous patch and there were more ways
      to exploit than using '|shellcmd'. So it doesn't make sense to reject only
      pipe character.
      
      Test cases are updated to actually try to exploit the bug. As the SSH bridge
      of git/svn subrepos are not managed by our code, the tests for non-hg subrepos
      are just removed.
      
      This may be folded into the original patches.
      4.3.1
      3fee7f7d2da0
  3. Aug 05, 2017
  4. Jul 31, 2017
    • Sean Farley's avatar
      subrepo: add tests for git rogue ssh urls (SEC) · db83a1df03fe
      Sean Farley authored
      'ssh://' has an exploit that will pass the url blindly to the ssh
      command, allowing a malicious person to have a subrepo with
      '-oProxyCommand' which could run arbitrary code on a user's machine. In
      addition, at least on Windows, a pipe '|' is able to execute arbitrary
      commands.
      
      When this happens, let's throw a big abort into the user's face so that
      they can inspect what's going on.
      db83a1df03fe
    • Sean Farley's avatar
      subrepo: add tests for svn rogue ssh urls (SEC) · 60ee7af2a2ba
      Sean Farley authored
      'ssh://' has an exploit that will pass the url blindly to the ssh
      command, allowing a malicious person to have a subrepo with
      '-oProxyCommand' which could run arbitrary code on a user's machine. In
      addition, at least on Windows, a pipe '|' is able to execute arbitrary
      commands.
      
      When this happens, let's throw a big abort into the user's face so that
      they can inspect what's going on.
      60ee7af2a2ba
    • Sean Farley's avatar
      subrepo: add tests for hg rogue ssh urls (SEC) · 475af2f89636
      Sean Farley authored
      'ssh://' has an exploit that will pass the url blindly to the ssh
      command, allowing a malicious person to have a subrepo with
      '-oProxyCommand' which could run arbitrary code on a user's machine. In
      addition, at least on Windows, a pipe '|' is able to execute arbitrary
      commands.
      
      When this happens, let's throw a big abort into the user's face so that
      they can inspect what's going on.
      475af2f89636
    • Sean Farley's avatar
      push: add tests for unsafe ssh url (SEC) · 48d520fdf880
      Sean Farley authored
      48d520fdf880
  5. Jul 28, 2017
  6. Aug 01, 2017
  7. Aug 04, 2017
  8. Jul 28, 2017
    • Sean Farley's avatar
      util: add utility method to check for bad ssh urls (SEC) · 0b3fe3910ef5
      Sean Farley authored
      Our use of SSH has an exploit that will parse the first part of an url
      blindly as a hostname. Prior to this set of security patches, a url
      with '-oProxyCommand' could run arbitrary code on a user's machine. In
      addition, at least on Windows, a pipe '|' can be abused to execute
      arbitrary commands in a similar fashion.
      
      We defend against this by checking ssh:// URLs and looking for a
      hostname that starts with a - or contains a |.
      
      When this happens, let's throw a big abort into the user's face so
      that they can inspect what's going on.
      0b3fe3910ef5
  9. Jul 26, 2017
    • Yuya Nishihara's avatar
      pathauditor: disable cache of audited paths by default (issue5628) · 377e8ddaebef
      Yuya Nishihara authored
      The initial attempt was to discard cache when appropriate, but it appears
      to be error prone. We had to carefully inspect all places where audit() is
      called e.g. without actually updating filesystem, before removing files and
      directories, etc.
      
      So, this patch disables the cache of audited paths by default, and enables
      it only for the following cases:
      
       - short-lived auditor objects
       - repo.vfs, repo.svfs, and repo.cachevfs, which are managed directories
         and considered sort of append-only (a file/directory would never be
         replaced with a symlink)
      
      There would be more cacheable vfs objects (e.g. mq.queue.opener), but I
      decided not to inspect all of them in this patch. We can make them cached
      later.
      
      Benchmark result:
      
      - using old clone of http://selenic.com/repo/linux-2.6/ (38319 files)
      - on tmpfs
      - run HGRCPATH=/dev/null hg up -q --time tip && hg up -q null
      - try 4 times and take the last three results
      
      original:
      real 7.480 secs (user 1.140+22.760 sys 0.150+1.690)
      real 8.010 secs (user 1.070+22.280 sys 0.170+2.120)
      real 7.470 secs (user 1.120+22.390 sys 0.120+1.910)
      
      clearcache (the other series):
      real 7.680 secs (user 1.120+23.420 sys 0.140+1.970)
      real 7.670 secs (user 1.110+23.620 sys 0.130+1.810)
      real 7.740 secs (user 1.090+23.510 sys 0.160+1.940)
      
      enable cache only for vfs and svfs (this series):
      real 8.730 secs (user 1.500+25.190 sys 0.260+2.260)
      real 8.750 secs (user 1.490+25.170 sys 0.250+2.340)
      real 9.010 secs (user 1.680+25.340 sys 0.280+2.540)
      
      remove cache function at all (for reference):
      real 9.620 secs (user 1.440+27.120 sys 0.250+2.980)
      real 9.420 secs (user 1.400+26.940 sys 0.320+3.130)
      real 9.760 secs (user 1.530+27.270 sys 0.250+2.970)
      377e8ddaebef
  10. Aug 01, 2017
  11. Aug 10, 2017
  12. Aug 07, 2017
    • Yuya Nishihara's avatar
      ssh: unban the use of pipe character in user@host:port string · 943c91326b23
      Yuya Nishihara authored
      This vulnerability was fixed by the previous patch and there were more ways
      to exploit than using '|shellcmd'. So it doesn't make sense to reject only
      pipe character.
      
      Test cases are updated to actually try to exploit the bug. As the SSH bridge
      of git/svn subrepos are not managed by our code, the tests for non-hg subrepos
      are just removed.
      
      This may be folded into the original patches.
      4.2.3
      943c91326b23
  13. Aug 05, 2017
  14. Jul 31, 2017
    • Sean Farley's avatar
      subrepo: add tests for git rogue ssh urls (SEC) · ca398a50ca00
      Sean Farley authored
      'ssh://' has an exploit that will pass the url blindly to the ssh
      command, allowing a malicious person to have a subrepo with
      '-oProxyCommand' which could run arbitrary code on a user's machine. In
      addition, at least on Windows, a pipe '|' is able to execute arbitrary
      commands.
      
      When this happens, let's throw a big abort into the user's face so that
      they can inspect what's going on.
      ca398a50ca00
    • Sean Farley's avatar
      subrepo: add tests for svn rogue ssh urls (SEC) · 173ecccb9ee7
      Sean Farley authored
      'ssh://' has an exploit that will pass the url blindly to the ssh
      command, allowing a malicious person to have a subrepo with
      '-oProxyCommand' which could run arbitrary code on a user's machine. In
      addition, at least on Windows, a pipe '|' is able to execute arbitrary
      commands.
      
      When this happens, let's throw a big abort into the user's face so that
      they can inspect what's going on.
      173ecccb9ee7
    • Sean Farley's avatar
      subrepo: add tests for hg rogue ssh urls (SEC) · 55681baf4cf9
      Sean Farley authored
      'ssh://' has an exploit that will pass the url blindly to the ssh
      command, allowing a malicious person to have a subrepo with
      '-oProxyCommand' which could run arbitrary code on a user's machine. In
      addition, at least on Windows, a pipe '|' is able to execute arbitrary
      commands.
      
      When this happens, let's throw a big abort into the user's face so that
      they can inspect what's going on.
      55681baf4cf9
    • Sean Farley's avatar
      push: add tests for unsafe ssh url (SEC) · 08cfc4baf3ba
      Sean Farley authored
      08cfc4baf3ba
  15. Jul 28, 2017
  16. Aug 01, 2017
  17. Aug 04, 2017
  18. Jul 28, 2017
    • Sean Farley's avatar
      util: add utility method to check for bad ssh urls (SEC) · 53224b1ffbc2
      Sean Farley authored
      Our use of SSH has an exploit that will parse the first part of an url
      blindly as a hostname. Prior to this set of security patches, a url
      with '-oProxyCommand' could run arbitrary code on a user's machine. In
      addition, at least on Windows, a pipe '|' can be abused to execute
      arbitrary commands in a similar fashion.
      
      We defend against this by checking ssh:// URLs and looking for a
      hostname that starts with a - or contains a |.
      
      When this happens, let's throw a big abort into the user's face so
      that they can inspect what's going on.
      53224b1ffbc2
  19. Jul 26, 2017
    • Yuya Nishihara's avatar
      pathauditor: disable cache of audited paths by default (issue5628) · 20bac46f7744
      Yuya Nishihara authored
      The initial attempt was to discard cache when appropriate, but it appears
      to be error prone. We had to carefully inspect all places where audit() is
      called e.g. without actually updating filesystem, before removing files and
      directories, etc.
      
      So, this patch disables the cache of audited paths by default, and enables
      it only for the following cases:
      
       - short-lived auditor objects
       - repo.vfs, repo.svfs, and repo.cachevfs, which are managed directories
         and considered sort of append-only (a file/directory would never be
         replaced with a symlink)
      
      There would be more cacheable vfs objects (e.g. mq.queue.opener), but I
      decided not to inspect all of them in this patch. We can make them cached
      later.
      
      Benchmark result:
      
      - using old clone of http://selenic.com/repo/linux-2.6/ (38319 files)
      - on tmpfs
      - run HGRCPATH=/dev/null hg up -q --time tip && hg up -q null
      - try 4 times and take the last three results
      
      original:
      real 7.480 secs (user 1.140+22.760 sys 0.150+1.690)
      real 8.010 secs (user 1.070+22.280 sys 0.170+2.120)
      real 7.470 secs (user 1.120+22.390 sys 0.120+1.910)
      
      clearcache (the other series):
      real 7.680 secs (user 1.120+23.420 sys 0.140+1.970)
      real 7.670 secs (user 1.110+23.620 sys 0.130+1.810)
      real 7.740 secs (user 1.090+23.510 sys 0.160+1.940)
      
      enable cache only for vfs and svfs (this series):
      real 8.730 secs (user 1.500+25.190 sys 0.260+2.260)
      real 8.750 secs (user 1.490+25.170 sys 0.250+2.340)
      real 9.010 secs (user 1.680+25.340 sys 0.280+2.540)
      
      remove cache function at all (for reference):
      real 9.620 secs (user 1.440+27.120 sys 0.250+2.980)
      real 9.420 secs (user 1.400+26.940 sys 0.320+3.130)
      real 9.760 secs (user 1.530+27.270 sys 0.250+2.970)
      20bac46f7744
  20. Aug 01, 2017
  21. Aug 10, 2017
  22. Aug 07, 2017
  23. Aug 05, 2017
    • Kostia Balytskyi's avatar
      ui: make sure buffer is flushed before waiting for user input (issue5587) · c2c6a0f7408b
      Kostia Balytskyi authored
      Without this patch on Windows 'hg ci -i' hangs waiting for user input
      and "examine changes to 'file'? [Ynesfdaq?]" is never displayed (at least
      if the diff is sufficiently small). When Ctrl+C is pressed, this prompt
      becomes visible, which suggests that the buffer just wasn't flushed.
      I've never seen this happening on Linux, but this looks harmless enough
      to not platform-gate it.
      c2c6a0f7408b
  24. Aug 02, 2017
Loading