Mercurial Mercurial > mercurial / file revision
summary | shortlog | changelog | graph | tags | bookmarks | branches | files | changeset | file | latest | revisions | annotate | diff | comparison | raw | help
Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
tests/test-hgweb-auth.py.out
author Yuya Nishihara <yuya@tcha.org>
Mon, 07 Aug 2017 22:22:28 +0900
branchstable
changeset 33660 3fee7f7d2da0
parent 15024 0f1311e829c9
child 37940 31c37e703cee
permissions -rw-r--r--
ssh: unban the use of pipe character in user@host:port string This vulnerability was fixed by the previous patch and there were more ways to exploit than using '|shellcmd'. So it doesn't make sense to reject only pipe character. Test cases are updated to actually try to exploit the bug. As the SSH bridge of git/svn subrepos are not managed by our code, the tests for non-hg subrepos are just removed. This may be folded into the original patches.


*** Test in-uri schemes

CFG: {x.prefix: http://example.org}
URI: http://example.org/foo
     ('x', 'x')
URI: http://example.org/foo/bar
     ('x', 'x')
URI: http://example.org/bar
     ('x', 'x')
URI: https://example.org/foo
     abort
URI: https://example.org/foo/bar
     abort
URI: https://example.org/bar
     abort
URI: https://x@example.org/bar
     abort
URI: https://y@example.org/bar
     abort
CFG: {x.prefix: https://example.org}
URI: http://example.org/foo
     abort
URI: http://example.org/foo/bar
     abort
URI: http://example.org/bar
     abort
URI: https://example.org/foo
     ('x', 'x')
URI: https://example.org/foo/bar
     ('x', 'x')
URI: https://example.org/bar
     ('x', 'x')
URI: https://x@example.org/bar
     ('x', 'x')
URI: https://y@example.org/bar
     abort
CFG: {x.prefix: http://example.org, x.schemes: https}
URI: http://example.org/foo
     ('x', 'x')
URI: http://example.org/foo/bar
     ('x', 'x')
URI: http://example.org/bar
     ('x', 'x')
URI: https://example.org/foo
     abort
URI: https://example.org/foo/bar
     abort
URI: https://example.org/bar
     abort
URI: https://x@example.org/bar
     abort
URI: https://y@example.org/bar
     abort
CFG: {x.prefix: https://example.org, x.schemes: http}
URI: http://example.org/foo
     abort
URI: http://example.org/foo/bar
     abort
URI: http://example.org/bar
     abort
URI: https://example.org/foo
     ('x', 'x')
URI: https://example.org/foo/bar
     ('x', 'x')
URI: https://example.org/bar
     ('x', 'x')
URI: https://x@example.org/bar
     ('x', 'x')
URI: https://y@example.org/bar
     abort

*** Test separately configured schemes

CFG: {x.prefix: example.org, x.schemes: http}
URI: http://example.org/foo
     ('x', 'x')
URI: http://example.org/foo/bar
     ('x', 'x')
URI: http://example.org/bar
     ('x', 'x')
URI: https://example.org/foo
     abort
URI: https://example.org/foo/bar
     abort
URI: https://example.org/bar
     abort
URI: https://x@example.org/bar
     abort
URI: https://y@example.org/bar
     abort
CFG: {x.prefix: example.org, x.schemes: https}
URI: http://example.org/foo
     abort
URI: http://example.org/foo/bar
     abort
URI: http://example.org/bar
     abort
URI: https://example.org/foo
     ('x', 'x')
URI: https://example.org/foo/bar
     ('x', 'x')
URI: https://example.org/bar
     ('x', 'x')
URI: https://x@example.org/bar
     ('x', 'x')
URI: https://y@example.org/bar
     abort
CFG: {x.prefix: example.org, x.schemes: http https}
URI: http://example.org/foo
     ('x', 'x')
URI: http://example.org/foo/bar
     ('x', 'x')
URI: http://example.org/bar
     ('x', 'x')
URI: https://example.org/foo
     ('x', 'x')
URI: https://example.org/foo/bar
     ('x', 'x')
URI: https://example.org/bar
     ('x', 'x')
URI: https://x@example.org/bar
     ('x', 'x')
URI: https://y@example.org/bar
     abort

*** Test prefix matching

CFG: {x.prefix: http://example.org/foo, y.prefix: http://example.org/bar}
URI: http://example.org/foo
     ('x', 'x')
URI: http://example.org/foo/bar
     ('x', 'x')
URI: http://example.org/bar
     ('y', 'y')
URI: https://example.org/foo
     abort
URI: https://example.org/foo/bar
     abort
URI: https://example.org/bar
     abort
URI: https://x@example.org/bar
     abort
URI: https://y@example.org/bar
     abort
CFG: {x.prefix: http://example.org/foo, y.prefix: http://example.org/foo/bar}
URI: http://example.org/foo
     ('x', 'x')
URI: http://example.org/foo/bar
     ('y', 'y')
URI: http://example.org/bar
     abort
URI: https://example.org/foo
     abort
URI: https://example.org/foo/bar
     abort
URI: https://example.org/bar
     abort
URI: https://x@example.org/bar
     abort
URI: https://y@example.org/bar
     abort
CFG: {x.prefix: *, y.prefix: https://example.org/bar}
URI: http://example.org/foo
     abort
URI: http://example.org/foo/bar
     abort
URI: http://example.org/bar
     abort
URI: https://example.org/foo
     ('x', 'x')
URI: https://example.org/foo/bar
     ('x', 'x')
URI: https://example.org/bar
     ('y', 'y')
URI: https://x@example.org/bar
     ('x', 'x')
URI: https://y@example.org/bar
     ('y', 'y')

*** Test user matching

CFG: {x.password: xpassword, x.prefix: http://example.org/foo, x.username: None}
URI: http://y@example.org/foo
     ('y', 'xpassword')
CFG: {x.password: xpassword, x.prefix: http://example.org/foo, x.username: None, y.password: ypassword, y.prefix: http://example.org/foo, y.username: y}
URI: http://y@example.org/foo
     ('y', 'ypassword')
CFG: {x.password: xpassword, x.prefix: http://example.org/foo/bar, x.username: None, y.password: ypassword, y.prefix: http://example.org/foo, y.username: y}
URI: http://y@example.org/foo/bar
     ('y', 'xpassword')

*** Test urllib2 and util.url

URIs: http://user@example.com:8080/foo http://example.com:8080/foo
('user', '')
mercurial