convert: test for shell injection in git calls (SEC)
CVE-2016-3069 (5/5)
Before recent refactoring we were not escaping calls to git at all
which made such injections possible. Let's have a test for that to
avoid this problem in the future. Reported by Blake Burkhart.
$ cat >> $HGRCPATH << EOF
> [ui]
> logtemplate="{rev}:{node|short} ({phase}) [{tags} {bookmarks}] {desc|firstline}\n"
> [extensions]
> dirstateparanoidcheck = $TESTDIR/../contrib/dirstatenonnormalcheck.py
> [experimental]
> nonnormalparanoidcheck = True
> [devel]
> all-warnings=True
> EOF
$ mkcommit() {
> echo "$1" > "$1"
> hg add "$1"
> hg ci -m "add $1"
> }
$ hg init testrepo
$ cd testrepo
$ mkcommit a
$ mkcommit b
$ mkcommit c
$ hg status