Page MenuHomePhabricator

Importing Mercurial repo with blackbox extension enabled results in non-completing import and erroneneous revision
Closed, WontfixPublic

Description

If Phabricator is used to import a Mercurial repository which has the blackbox extension enabled, the import will never complete, and the revision log at https://example.com/diffusion/HG/ will show an extra revision at the top, "rHGwarning: cannot write to blackbox.log: Permission denied"; clicking the link results in a HTTP 404 error.

The blackbox extention, documented at https://mercurial.selenic.com/wiki/BlackboxExtension creates a log of operations into .hg/blackbox.log .

Event Timeline

bcran updated the task description. (Show Details)
bcran added projects: Diffusion, Mercurial.
bcran added a subscriber: bcran.
bcran renamed this task from Importing Mercurial repo with blackbox extension enabled results in non-completing import and superfluous revision to Importing Mercurial repo with blackbox extension enabled results in non-completing import and erroneneous revision.Sep 11 2015, 2:49 AM

Why are you interested in running this extension?

In particular, Phabricator already records all write operations in the repository "Push Log", so repository state is completely reconstructable across force pushes, ref changes, etc.

It's unclear why you would want to log reads made by Phabricator. There will be a huge volume of these events on an active server, and I don't see how they could ever be useful.

The erroneous revision is because when hg log is invoked with --debug, it prints arbitrary messages to stdout which we can not distinguish from log output.

We must use --debug on Mercurial versions older than 2.4 (basically, prior to my June 2012 Mercurial patch, see T5554#133984) because there is no way to obtain full commit hashes from the log output otherwise.

We filter specific well-known messages in PhabricatorRepository::filterMercurialDebugOutput() but can not possibly blacklist every message every extension may emit.

Why are you interested in running this extension?

This is an external repository where we want to record push operations done via ssh. We're currently only using Phabricator for the repo browser feature.

Can you just disable the extension for Phabricator's copy of the repository?

Yup, I understand now: we enable the extension system-wide, so I'll update the hgrc in Phabricator's clone of the repo with "blackbox = !" to disable it.

Since I have a workaround should I close this? Or, since my system's using Mercurial 3.5.1 should the code be skipping the workaround for older versions?

epriestley closed this task as Wontfix.EditedSep 11 2015, 3:18 AM
epriestley claimed this task.

Cool, that sounds reasonable. Broadly:

  • The value of this extension in the general case for Phabricator working copies isn't clear (Phabricator maintains a similar log for hosted writes; reads don't seem meaningful to log).
  • In this specific case, it's intentional that the webserver does not have write access to the repository. This limits the ability of an attacker who gains ground in the web application to compromise repositories. Giving the websever write access would weaken the security model. The writes it would perform seem meaningless (e.g., thousands of read-only hg log, hg cat, hg annotate, etc., operations). Even if there was some motivation for logging these events, it's difficult to imagine it would be strong enough to justify weakening the security model, or ever desirable to trade strong privilege separation away to get a lot of reads logged.
  • See also T6118.