contrib/fixpax.py
author Augie Fackler <augie@google.com>
Wed, 12 Apr 2017 11:23:55 -0700
branchstable
changeset 32050 77eaf9539499
parent 28354 00f317788d33
permissions -rwxr-xr-x
dispatch: protect against malicious 'hg serve --stdio' invocations (sec) Some shared-ssh installations assume that 'hg serve --stdio' is a safe command to run for minimally trusted users. Unfortunately, the messy implementation of argument parsing here meant that trying to access a repo named '--debugger' would give the user a pdb prompt, thereby sidestepping any hoped-for sandboxing. Serving repositories over HTTP(S) is unaffected. We're not currently hardening any subcommands other than 'serve'. If your service exposes other commands to users with arbitrary repository names, it is imperative that you defend against repository names of '--debugger' and anything starting with '--config'. The read-only mode of hg-ssh stopped working because it provided its hook configuration to "hg serve --stdio" via --config parameter. This is banned for security reasons now. This patch switches it to directly call ui.setconfig(). If your custom hosting infrastructure relies on passing --config to "hg serve --stdio", you'll need to find a different way to get that configuration into Mercurial, either by using ui.setconfig() as hg-ssh does in this patch, or by placing an hgrc file someplace where Mercurial will read it. mitrandir@fb.com provided some extra fixes for the dispatch code and for hg-ssh in places that I overlooked.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
27495
58eb1c5bba58 contrib: add execute bit for fixpax.py
timeless <timeless@mozdev.org>
parents: 23940
diff changeset
     1
#!/usr/bin/env python
23940
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
     2
# fixpax - fix ownership in bdist_mpkg output
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
     3
#
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
     4
# Copyright 2015 Matt Mackall <mpm@selenic.com>
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
     5
#
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
     6
# This software may be used and distributed according to the terms of the
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
     7
# MIT license (http://opensource.org/licenses/MIT)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
     8
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
     9
"""Set file ownership to 0 in an Archive.pax.gz.
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    10
Suitable for fixing files bdist_mpkg output:
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    11
*.mpkg/Contents/Packages/*.pkg/Contents/Archive.pax.gz
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    12
"""
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    13
28354
00f317788d33 fixpax: use absolute_import and print_function
Pulkit Goyal <7895pulkit@gmail.com>
parents: 27495
diff changeset
    14
from __future__ import absolute_import, print_function
00f317788d33 fixpax: use absolute_import and print_function
Pulkit Goyal <7895pulkit@gmail.com>
parents: 27495
diff changeset
    15
import gzip
00f317788d33 fixpax: use absolute_import and print_function
Pulkit Goyal <7895pulkit@gmail.com>
parents: 27495
diff changeset
    16
import os
00f317788d33 fixpax: use absolute_import and print_function
Pulkit Goyal <7895pulkit@gmail.com>
parents: 27495
diff changeset
    17
import sys
23940
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    18
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    19
def fixpax(iname, oname):
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    20
    i = gzip.GzipFile(iname)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    21
    o = gzip.GzipFile(oname, "w")
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    22
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    23
    while True:
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    24
        magic = i.read(6)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    25
        dev = i.read(6)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    26
        ino = i.read(6)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    27
        mode = i.read(6)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    28
        i.read(6) # uid
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    29
        i.read(6) # gid
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    30
        nlink = i.read(6)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    31
        rdev = i.read(6)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    32
        mtime = i.read(11)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    33
        namesize = i.read(6)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    34
        filesize = i.read(11)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    35
        name = i.read(int(namesize, 8))
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    36
        data = i.read(int(filesize, 8))
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    37
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    38
        o.write(magic)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    39
        o.write(dev)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    40
        o.write(ino)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    41
        o.write(mode)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    42
        o.write("000000")
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    43
        o.write("000000")
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    44
        o.write(nlink)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    45
        o.write(rdev)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    46
        o.write(mtime)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    47
        o.write(namesize)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    48
        o.write(filesize)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    49
        o.write(name)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    50
        o.write(data)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    51
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    52
        if name.startswith("TRAILER!!!"):
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    53
            o.write(i.read())
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    54
            break
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    55
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    56
    o.close()
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    57
    i.close()
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    58
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    59
if __name__ == '__main__':
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    60
    for iname in sys.argv[1:]:
28354
00f317788d33 fixpax: use absolute_import and print_function
Pulkit Goyal <7895pulkit@gmail.com>
parents: 27495
diff changeset
    61
        print('fixing file ownership in %s' % iname)
23940
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    62
        oname = sys.argv[1] + '.tmp'
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    63
        fixpax(iname, oname)
d0ef40776999 osx: patch .pax.gz files in pkg bundles so they extract as root (issue4081)
Mads Kiilerich <madski@unity3d.com>
parents:
diff changeset
    64
        os.rename(oname, iname)