mercurial/dirstateguard.py
author Augie Fackler <augie@google.com>
Wed, 12 Apr 2017 11:23:55 -0700
branchstable
changeset 32050 77eaf9539499
parent 30488 751639bf6fc4
child 33440 ec306bc6915b
permissions -rw-r--r--
dispatch: protect against malicious 'hg serve --stdio' invocations (sec) Some shared-ssh installations assume that 'hg serve --stdio' is a safe command to run for minimally trusted users. Unfortunately, the messy implementation of argument parsing here meant that trying to access a repo named '--debugger' would give the user a pdb prompt, thereby sidestepping any hoped-for sandboxing. Serving repositories over HTTP(S) is unaffected. We're not currently hardening any subcommands other than 'serve'. If your service exposes other commands to users with arbitrary repository names, it is imperative that you defend against repository names of '--debugger' and anything starting with '--config'. The read-only mode of hg-ssh stopped working because it provided its hook configuration to "hg serve --stdio" via --config parameter. This is banned for security reasons now. This patch switches it to directly call ui.setconfig(). If your custom hosting infrastructure relies on passing --config to "hg serve --stdio", you'll need to find a different way to get that configuration into Mercurial, either by using ui.setconfig() as hg-ssh does in this patch, or by placing an hgrc file someplace where Mercurial will read it. mitrandir@fb.com provided some extra fixes for the dispatch code and for hg-ssh in places that I overlooked.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
30488
751639bf6fc4 dirstateguard: move to new module so I can break some layering violations
Augie Fackler <augie@google.com>
parents: 30473
diff changeset
     1
# dirstateguard.py - class to allow restoring dirstate after failure
2874
4ec58b157265 refactor text diff/patch code.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff changeset
     2
#
4635
63b9d2deed48 Updated copyright notices and add "and others" to "hg version"
Thomas Arendsen Hein <thomas@intevation.de>
parents: 4633
diff changeset
     3
# Copyright 2005-2007 Matt Mackall <mpm@selenic.com>
2874
4ec58b157265 refactor text diff/patch code.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff changeset
     4
#
8225
46293a0c7e9f updated license to be explicit about GPL version 2
Martin Geisler <mg@lazybytes.net>
parents: 8210
diff changeset
     5
# This software may be used and distributed according to the terms of the
10263
25e572394f5c Update license to GPLv2+
Matt Mackall <mpm@selenic.com>
parents: 10249
diff changeset
     6
# GNU General Public License version 2 or any later version.
2874
4ec58b157265 refactor text diff/patch code.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff changeset
     7
28322
ebd0e86bdf89 cmdutil: use absolute_import
Gregory Szorc <gregory.szorc@gmail.com>
parents: 28313
diff changeset
     8
from __future__ import absolute_import
ebd0e86bdf89 cmdutil: use absolute_import
Gregory Szorc <gregory.szorc@gmail.com>
parents: 28313
diff changeset
     9
ebd0e86bdf89 cmdutil: use absolute_import
Gregory Szorc <gregory.szorc@gmail.com>
parents: 28313
diff changeset
    10
from .i18n import _
ebd0e86bdf89 cmdutil: use absolute_import
Gregory Szorc <gregory.szorc@gmail.com>
parents: 28313
diff changeset
    11
ebd0e86bdf89 cmdutil: use absolute_import
Gregory Szorc <gregory.szorc@gmail.com>
parents: 28313
diff changeset
    12
from . import (
ebd0e86bdf89 cmdutil: use absolute_import
Gregory Szorc <gregory.szorc@gmail.com>
parents: 28313
diff changeset
    13
    error,
ebd0e86bdf89 cmdutil: use absolute_import
Gregory Szorc <gregory.szorc@gmail.com>
parents: 28313
diff changeset
    14
)
27624
d46db4390715 resolve: suggest the next action
timeless <timeless@mozdev.org>
parents: 27622
diff changeset
    15
24991
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    16
class dirstateguard(object):
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    17
    '''Restore dirstate at unexpected failure.
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    18
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    19
    At the construction, this class does:
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    20
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    21
    - write current ``repo.dirstate`` out, and
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    22
    - save ``.hg/dirstate`` into the backup file
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    23
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    24
    This restores ``.hg/dirstate`` from backup file, if ``release()``
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    25
    is invoked before ``close()``.
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    26
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    27
    This just removes the backup file at ``close()`` before ``release()``.
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    28
    '''
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    29
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    30
    def __init__(self, repo, name):
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    31
        self._repo = repo
30182
144d8fe266d9 cmdutil: satisfy expections in dirstateguard.__del__, even if __init__ fails
Mads Kiilerich <madski@unity3d.com>
parents: 30151
diff changeset
    32
        self._active = False
144d8fe266d9 cmdutil: satisfy expections in dirstateguard.__del__, even if __init__ fails
Mads Kiilerich <madski@unity3d.com>
parents: 30151
diff changeset
    33
        self._closed = False
26632
59b5e8844eb0 dirstate: move code paths for backup from dirstateguard to dirstate
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 26587
diff changeset
    34
        self._suffix = '.backup.%s.%d' % (name, id(self))
29137
d115cbf5980b dirstate: make backup methods public
Mateusz Kwapich <mitrandir@fb.com>
parents: 29103
diff changeset
    35
        repo.dirstate.savebackup(repo.currenttransaction(), self._suffix)
24991
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    36
        self._active = True
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    37
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    38
    def __del__(self):
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    39
        if self._active: # still active
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    40
            # this may occur, even if this class is used correctly:
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    41
            # for example, releasing other resources like transaction
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    42
            # may raise exception before ``dirstateguard.release`` in
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    43
            # ``release(tr, ....)``.
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    44
            self._abort()
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    45
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    46
    def close(self):
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    47
        if not self._active: # already inactivated
26632
59b5e8844eb0 dirstate: move code paths for backup from dirstateguard to dirstate
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 26587
diff changeset
    48
            msg = (_("can't close already inactivated backup: dirstate%s")
59b5e8844eb0 dirstate: move code paths for backup from dirstateguard to dirstate
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 26587
diff changeset
    49
                   % self._suffix)
26587
56b2bcea2529 error: get Abort from 'error' instead of 'util'
Pierre-Yves David <pierre-yves.david@fb.com>
parents: 26579
diff changeset
    50
            raise error.Abort(msg)
24991
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    51
29137
d115cbf5980b dirstate: make backup methods public
Mateusz Kwapich <mitrandir@fb.com>
parents: 29103
diff changeset
    52
        self._repo.dirstate.clearbackup(self._repo.currenttransaction(),
26746
3c1d297fe929 dirstateguard: remove layering violation around saving/restoring backup
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 26742
diff changeset
    53
                                         self._suffix)
24991
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    54
        self._active = False
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    55
        self._closed = True
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    56
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    57
    def _abort(self):
29137
d115cbf5980b dirstate: make backup methods public
Mateusz Kwapich <mitrandir@fb.com>
parents: 29103
diff changeset
    58
        self._repo.dirstate.restorebackup(self._repo.currenttransaction(),
26746
3c1d297fe929 dirstateguard: remove layering violation around saving/restoring backup
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 26742
diff changeset
    59
                                           self._suffix)
24991
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    60
        self._active = False
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    61
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    62
    def release(self):
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    63
        if not self._closed:
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    64
            if not self._active: # already inactivated
26632
59b5e8844eb0 dirstate: move code paths for backup from dirstateguard to dirstate
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 26587
diff changeset
    65
                msg = (_("can't release already inactivated backup:"
59b5e8844eb0 dirstate: move code paths for backup from dirstateguard to dirstate
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 26587
diff changeset
    66
                         " dirstate%s")
59b5e8844eb0 dirstate: move code paths for backup from dirstateguard to dirstate
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 26587
diff changeset
    67
                       % self._suffix)
26587
56b2bcea2529 error: get Abort from 'error' instead of 'util'
Pierre-Yves David <pierre-yves.david@fb.com>
parents: 26579
diff changeset
    68
                raise error.Abort(msg)
24991
4169a4f83548 cmdutil: add class to restore dirstate during unexpected failure
FUJIWARA Katsunori <foozy@lares.dti.ne.jp>
parents: 24988
diff changeset
    69
            self._abort()