Mercurial > public > mercurial-scm > hg

comparison mercurial/util.py @ 1835:bdfb524d728a

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Validate paths before reading or writing files in repository or working dir. Fixes security relevant issue134.
author Thomas Arendsen Hein <thomas@intevation.de>
date Sat, 04 Mar 2006 19:01:45 +0100
parents 4ced57680ce7
children d314a89fa4f1
comparison
equal deleted inserted replaced
1834:24881eaebee3 1835:bdfb524d728a
361 hardlink = False 361 hardlink = False
362 shutil.copy(src, dst) 362 shutil.copy(src, dst)
363 else: 363 else:
364 shutil.copy(src, dst) 364 shutil.copy(src, dst)
365 365
366 def opener(base): 366 def audit_path(path):
367 """Abort if path contains dangerous components"""
368 parts = os.path.normcase(path).split(os.sep)
369 if (os.path.splitdrive(path)[0] or parts[0] in ('.hg', '')
370 or os.pardir in parts):
371 raise Abort(_("path contains illegal component: %s\n") % path)
372
373 def opener(base, audit=True):
367 """ 374 """
368 return a function that opens files relative to base 375 return a function that opens files relative to base
369 376
370 this function is used to hide the details of COW semantics and 377 this function is used to hide the details of COW semantics and
371 remote file access from higher level code. 378 remote file access from higher level code.
372 """ 379 """
373 p = base 380 p = base
381 audit_p = audit
374 382
375 def mktempcopy(name): 383 def mktempcopy(name):
376 d, fn = os.path.split(name) 384 d, fn = os.path.split(name)
377 fd, temp = tempfile.mkstemp(prefix=fn, dir=d) 385 fd, temp = tempfile.mkstemp(prefix=fn, dir=d)
378 fp = os.fdopen(fd, "wb") 386 fp = os.fdopen(fd, "wb")
399 rename(self.temp, self.__name) 407 rename(self.temp, self.__name)
400 def __del__(self): 408 def __del__(self):
401 self.close() 409 self.close()
402 410
403 def o(path, mode="r", text=False, atomic=False): 411 def o(path, mode="r", text=False, atomic=False):
412 if audit_p:
413 audit_path(path)
404 f = os.path.join(p, path) 414 f = os.path.join(p, path)
405 415
406 if not text: 416 if not text:
407 mode += "b" # for that other OS 417 mode += "b" # for that other OS
408 418