Mercurial > public > mercurial-scm > hg
view mercurial/strutil.py @ 28663:ae279d4a19e9 stable 3.7.3
convert: test for shell injection in git calls (SEC)
CVE-2016-3069 (5/5)
Before recent refactoring we were not escaping calls to git at all
which made such injections possible. Let's have a test for that to
avoid this problem in the future. Reported by Blake Burkhart.
author | Mateusz Kwapich <mitrandir@fb.com> |
---|---|
date | Tue, 22 Mar 2016 17:27:27 -0700 |
parents | b723f05ec49b |
children |
line wrap: on
line source
# strutil.py - string utilities for Mercurial # # Copyright 2006 Vadim Gelfer <vadim.gelfer@gmail.com> # # This software may be used and distributed according to the terms of the # GNU General Public License version 2 or any later version. from __future__ import absolute_import def findall(haystack, needle, start=0, end=None): if end is None: end = len(haystack) if end < 0: end += len(haystack) if start < 0: start += len(haystack) while start < end: c = haystack.find(needle, start, end) if c == -1: break yield c start = c + 1 def rfindall(haystack, needle, start=0, end=None): if end is None: end = len(haystack) if end < 0: end += len(haystack) if start < 0: start += len(haystack) while end >= 0: c = haystack.rfind(needle, start, end) if c == -1: break yield c end = c - 1