# HG changeset patch
# User Matt Harbison <matt_harbison@yahoo.com>
# Date 1522560438 14400
# Node ID 7de7bd407251af2bc98e5b809c8598ee95830daf
# Parent  177f3b90335fc49c23a8880de57dc865f0832849
server: ensure the incoming request falls under the prefix value

Prior to this, the first test asserted in wsgiref.validate.check_environ()
saying PATH didn't start with '/', but the second test served up the repo.  The
assertion was just added in this cycle (though the value of PATH is still wrong
without the assertion).  Allowing access to the repo at any URL outside of the
prefix is a long standing bug.  This also affected hgwebdir, at least when used
via --subrepo.

Paths are not being canonicalized, so accesses to things like 'foo/../bar' will
get tossed out here, unless the prefix also matches.

diff -r 177f3b90335f -r 7de7bd407251 mercurial/hgweb/server.py
--- a/mercurial/hgweb/server.py	Thu Mar 15 22:35:07 2018 -0700
+++ b/mercurial/hgweb/server.py	Sun Apr 01 01:27:18 2018 -0400
@@ -118,6 +118,14 @@
         self.sent_headers = False
         path, query = _splitURI(self.path)
 
+        # Ensure the slicing of path below is valid
+        if (path != self.server.prefix
+            and not path.startswith(self.server.prefix + b'/')):
+            self._start_response(common.statusmessage(404), [])
+            self._write("Not Found")
+            self._done()
+            return
+
         env = {}
         env[r'GATEWAY_INTERFACE'] = r'CGI/1.1'
         env[r'REQUEST_METHOD'] = self.command
diff -r 177f3b90335f -r 7de7bd407251 tests/test-serve.t
--- a/tests/test-serve.t	Thu Mar 15 22:35:07 2018 -0700
+++ b/tests/test-serve.t	Sun Apr 01 01:27:18 2018 -0400
@@ -78,4 +78,24 @@
   listening at http://localhost/foo/ (bound to *$LOCALIP*:HGPORT1) (glob) (?)
   % errors
 
+  $ $PYTHON $RUNTESTDIR/killdaemons.py $DAEMON_PIDS
+
+With out of bounds accesses
+
+  $ rm access.log
+  $ hg serve -a localhost -p $HGPORT -d --prefix some/dir \
+  >    --pid-file=hg.pid -E errors.log
+  $ cat hg.pid >> "$DAEMON_PIDS"
+
+  $ hg id http://localhost:$HGPORT/some/dir7
+  abort: HTTP Error 404: Not Found
+  [255]
+  $ hg id http://localhost:$HGPORT/some
+  abort: HTTP Error 404: Not Found
+  [255]
+
+  $ cat access.log errors.log
+  $LOCALIP - - [$LOGDATE$] "GET /some/dir7?cmd=capabilities HTTP/1.1" 404 - (glob)
+  $LOCALIP - - [$LOGDATE$] "GET /some?cmd=capabilities HTTP/1.1" 404 - (glob)
+
   $ cd ..