Fix Mercurial command injection vulnerability
ClosedPublic
Actions

Authored by epriestley on Mar 19 2015, 2:50 AM.

Details

Reviewers

Commits

Restricted Diffusion Commit
rP80b8dc521d14: Fix Mercurial command injection vulnerability

Summary

See http://chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.html.

Test Plan

Crafted bad remote URL; got error instead of code execution.

Diff Detail

Repository

rP Phabricator

Branch

hgvuln

Lint

Lint Passed

Unit

Tests Passed

Build Status

Buildable 4925
Build 4943: [Placeholder Plan] Wait for 30 Seconds

Event Timeline

epriestley updated this revision to Diff 29134.Mar 19 2015, 2:50 AM

epriestley retitled this revision from to Fix Mercurial command injection vulnerability.

epriestley updated this object.

epriestley edited the test plan for this revision. (Show Details)

epriestley added a reviewer: btrahan.

Herald added a subscriber: epriestley. · View Herald TranscriptMar 19 2015, 2:50 AM

btrahan accepted this revision.Mar 19 2015, 3:06 PM

btrahan edited edge metadata.

This revision is now accepted and ready to land.Mar 19 2015, 3:06 PM

btrahan awarded a token.Mar 19 2015, 3:07 PM

Closed by commit rP80b8dc521d14: Fix Mercurial command injection vulnerability (authored by epriestley, committed by epriestley). · Explain WhyMar 20 2015, 4:26 PM

This revision was automatically updated to reflect the committed changes.

epriestley mentioned this in T7785: Build a Phacility cluster service tier to sandbox Graphviz and Cowsay.Apr 8 2015, 6:21 PM

epriestley mentioned this in T5554: arc fails with svn/git/hg non english locales.Aug 26 2015, 2:51 PM

Revision Contents
Changeset List

Path

Size

src/

__phutil_library_map__.php

2 lines

applications/

config/

check/

PhabricatorBinariesSetupCheck.php

13 lines

repository/

constants/

PhabricatorRepositoryVersion.php

22 lines

engine/

PhabricatorRepositoryPullEngine.php

20 lines

Diff 29134

View Options

src/__phutil_library_map__.php

View Options

src/applications/config/check/PhabricatorBinariesSetupCheck.php

View Options

src/applications/repository/constants/PhabricatorRepositoryVersion.php

View Options

src/applications/repository/engine/PhabricatorRepositoryPullEngine.php

Fix Mercurial command injection vulnerabilityClosedPublicActions

Details

Diff Detail

Event Timeline

Revision ContentsChangeset List

Diff 29134

src/__phutil_library_map__.php

src/applications/config/check/PhabricatorBinariesSetupCheck.php

src/applications/repository/constants/PhabricatorRepositoryVersion.php

src/applications/repository/engine/PhabricatorRepositoryPullEngine.php

Fix Mercurial command injection vulnerability
ClosedPublic
Actions

Revision Contents
Changeset List