Page MenuHomePhabricator
Differential D12112

Fix Mercurial command injection vulnerability
ClosedPublic
Actions

Authored by epriestley on Mar 19 2015, 2:50 AM.
Tags
None
Referenced Files
F13191365: D12112.id.diff
Sat, May 11, 8:01 PM
F13189648: D12112.diff
Sat, May 11, 6:16 AM
F13184537: D12112.id.diff
Fri, May 10, 8:07 PM
F13182190: D12112.id29137.diff
Thu, May 9, 8:46 PM
Unknown Object (File)
Sat, May 4, 9:34 PM
Unknown Object (File)
Wed, May 1, 12:32 AM
Unknown Object (File)
Sat, Apr 27, 3:31 PM
Unknown Object (File)
Fri, Apr 12, 9:49 AM
View All Files
Subscribers
epriestley
Tokens
"Yellow Medal" token, awarded by btrahan.

Details

Reviewers
btrahan
Commits
Restricted Diffusion Commit
rP80b8dc521d14: Fix Mercurial command injection vulnerability
Summary

See http://chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.html.

Test Plan

Crafted bad remote URL; got error instead of code execution.

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Revision Contents
Changeset List

PathSize
src/
2 lines
applications/
config/
check/
13 lines
repository/
constants/
22 lines
engine/
30 lines

Diff 29137

View Options

src/__phutil_library_map__.php

Loading...
View Options

src/applications/config/check/PhabricatorBinariesSetupCheck.php

Loading...
View Options

src/applications/repository/constants/PhabricatorRepositoryVersion.php

Loading...
View Options

src/applications/repository/engine/PhabricatorRepositoryPullEngine.php

Loading...
Phabricator · Built by Phacility