Something went wrong. Try again.
@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.) hq.recaptime.dev/wiki/Phorge
phorge phabricator
Something went wrong. Try again.
4.4 kB · 122 lines
PHP
at commit 2f95330c
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123<?php
final class DiffusionMercurialCommandEngine extends DiffusionCommandEngine {
protected function canBuildForRepository( PhabricatorRepository $repository) { return $repository->isHg(); }
protected function newFormattedCommand($pattern, array $argv) { $args = array();
// Crudely blacklist commands which look like they may contain command // injection via "--config" or "--debugger". See T13012. To do this, we // print the whole command, parse it using shell rules, then examine each // argument to see if it looks like "--config" or "--debugger".
$test_command = call_user_func_array( 'csprintf', array_merge(array($pattern), $argv)); $test_args = id(new PhutilShellLexer()) ->splitArguments($test_command);
foreach ($test_args as $test_arg) { if (preg_match('/^--(config|debugger)/i', $test_arg)) { throw new DiffusionMercurialFlagInjectionException( pht( 'Mercurial command appears to contain unsafe injected "--config" '. 'or "--debugger": %s', $test_command)); } }
// NOTE: Here, and in Git and Subversion, we override the SSH command even // if the repository does not use an SSH remote, since our SSH wrapper // defuses an attack against older versions of Mercurial, Git and // Subversion (see T12961) and it's possible to execute this attack // in indirect ways, like by using an SSH subrepo inside an HTTP repo.
$pattern = "hg --config ui.ssh=%s {$pattern}"; $args[] = $this->getSSHWrapper();
return array($pattern, array_merge($args, $argv)); }
protected function newCustomEnvironment() { $env = array();
// NOTE: This overrides certain configuration, extensions, and settings // which make Mercurial commands do random unusual things. $env['HGPLAIN'] = 1;
return $env; }
/** * Sanitize output of an `hg` command invoked with the `--debug` flag to make * it usable. * * @param string Output from `hg --debug ...` * @return string Usable output. */ public static function filterMercurialDebugOutput($stdout) { // When hg commands are run with `--debug` and some config file isn't // trusted, Mercurial prints out a warning to stdout, twice, after Feb 2011. // // http://selenic.com/pipermail/mercurial-devel/2011-February/028541.html // // After Jan 2015, it may also fail to write to a revision branch cache. // // Separately, it may fail to write to a different branch cache, and may // encounter issues reading the branch cache. // // When Mercurial repositories are hosted on external systems with // multi-user environments it's possible that the branch cache is computed // on a revision which does not end up being published. When this happens it // will recompute the cache but also print out "invalid branch cache". // // https://www.mercurial-scm.org/pipermail/mercurial/2014-June/047239.html // // When observing a repository which uses largefiles, the debug output may // also contain extraneous output about largefile changes. // // At some point Mercurial added/improved support for pager used when // command output is large. It includes printing out debug information that // the pager is being started for a command. This seems to happen despite // the output of the command being piped/read from another process. // // When printing color output Mercurial may run into some issue with the // terminal info. This should never happen in Phabricator since color // output should be turned off, however in the event it shows up we should // filter it out anyways.
$ignore = array( 'ignoring untrusted configuration option', "couldn't write revision branch cache:", "couldn't write branch cache:", 'invalid branchheads cache', 'invalid branch cache', 'updated patterns: .hglf', 'starting pager for command', 'no terminfo entry for', );
foreach ($ignore as $key => $pattern) { $ignore[$key] = preg_quote($pattern, '/'); }
$ignore = '('.implode('|', $ignore).')';
$lines = preg_split('/(?<=\n)/', $stdout); $regex = '/'.$ignore.'.*\n$/';
foreach ($lines as $key => $line) { $lines[$key] = preg_replace($regex, '', $line); }
return implode('', $lines); }
}