# HG changeset patch
# User Blake Burkhart <bburky@bburky.com>
# Date 1460001466 18000
# Node ID a56296f55a5e1038ea5016dace2076b693c28a56
# Parent  27ad6cae7785b59f918f5e3ed33a2f1e88a60d4f
convert: pass absolute paths to git (SEC)

Fixes CVE-2016-3105 (1/1).

Previously, it was possible for the repository path passed to git-ls-remote
to be misinterpreted as a URL.

Always passing an absolute path to git is a simple way to avoid this.

diff -r 27ad6cae7785 -r a56296f55a5e hgext/convert/git.py
--- a/hgext/convert/git.py	Sun May 01 13:52:26 2016 -0500
+++ b/hgext/convert/git.py	Wed Apr 06 22:57:46 2016 -0500
@@ -57,6 +57,10 @@
         super(convert_git, self).__init__(ui, path, revs=revs)
         common.commandline.__init__(self, ui, 'git')
 
+        # Pass an absolute path to git to prevent from ever being interpreted
+        # as a URL
+        path = os.path.abspath(path)
+
         if os.path.isdir(path + "/.git"):
             path += "/.git"
         if not os.path.exists(path + "/objects"):
diff -r 27ad6cae7785 -r a56296f55a5e tests/test-convert-git.t
--- a/tests/test-convert-git.t	Sun May 01 13:52:26 2016 -0500
+++ b/tests/test-convert-git.t	Wed Apr 06 22:57:46 2016 -0500
@@ -714,7 +714,7 @@
   $ COMMIT_OBJ=1c/0ce3c5886f83a1d78a7b517cdff5cf9ca17bdd
   $ mv git-repo4/.git/objects/$COMMIT_OBJ git-repo4/.git/objects/$COMMIT_OBJ.tmp
   $ hg convert git-repo4 git-repo4-broken-hg 2>&1 | grep 'abort:'
-  abort: cannot retrieve number of commits in git-repo4/.git
+  abort: cannot retrieve number of commits in $TESTTMP/git-repo4/.git
   $ mv git-repo4/.git/objects/$COMMIT_OBJ.tmp git-repo4/.git/objects/$COMMIT_OBJ
 damage git repository by renaming a blob object
 
@@ -749,5 +749,22 @@
   $ test -f COMMAND-INJECTION
   [1]
 
+test for safely passing paths to git (CVE-2016-3105)
+
+  $ git init 'ext::sh -c echo% pwned% >GIT-EXT-COMMAND-INJECTION% #'
+  Initialized empty Git repository in $TESTTMP/ext::sh -c echo% pwned% >GIT-EXT-COMMAND-INJECTION% #/.git/
+  $ cd 'ext::sh -c echo% pwned% >GIT-EXT-COMMAND-INJECTION% #'
+  $ git commit -q --allow-empty -m 'empty'
+  $ cd ..
+  $ hg convert 'ext::sh -c echo% pwned% >GIT-EXT-COMMAND-INJECTION% #' 'converted-git-ext'
+  initializing destination converted-git-ext repository
+  scanning source...
+  sorting...
+  converting...
+  0 empty
+  updating bookmarks
+  $ test -f GIT-EXT-COMMAND-INJECTION
+  [1]
+
 #endif
 
diff -r 27ad6cae7785 -r a56296f55a5e tests/test-convert.t
--- a/tests/test-convert.t	Sun May 01 13:52:26 2016 -0500
+++ b/tests/test-convert.t	Wed Apr 06 22:57:46 2016 -0500
@@ -422,7 +422,7 @@
   assuming destination emptydir-hg
   initializing destination emptydir-hg repository
   emptydir does not look like a CVS checkout
-  emptydir does not look like a Git repository
+  $TESTTMP/emptydir does not look like a Git repository
   emptydir does not look like a Subversion repository
   emptydir is not a local Mercurial repository
   emptydir does not look like a darcs repository