Comments
Patch
@@ -946,11 +946,11 @@ damage git repository by renaming a tree
$ TREE_OBJ=72/49f083d2a63a41cc737764a86981eb5f3e4635
$ mv git-repo4/.git/objects/$TREE_OBJ git-repo4/.git/objects/$TREE_OBJ.tmp
$ hg convert git-repo4 git-repo4-broken-hg 2>&1 | grep 'abort:'
abort: cannot read changes in 1c0ce3c5886f83a1d78a7b517cdff5cf9ca17bdd
-#if no-windows
+#if no-windows git19
test for escaping the repo name (CVE-2016-3069)
$ git init '`echo pwned >COMMAND-INJECTION`'
Initialized empty Git repository in $TESTTMP/`echo pwned >COMMAND-INJECTION`/.git/
@@ -1135,10 +1135,12 @@ make sure we show changed files, rather
? s/c.c
? s/cpp.cpp
? s/foobar.orig
? s/snake.python.orig
+#if git19
+
test for Git CVE-2016-3068
$ hg init malicious-subrepository
$ cd malicious-subrepository
$ echo "s = [git]ext::sh -c echo% pwned:% \$PWNED_MSG% >pwned.txt" > .hgsub
$ git init s
@@ -1176,5 +1178,7 @@ whitelisting of ext should be respected
cloning subrepo s from ext::sh -c echo% pwned:% $PWNED_MSG% >pwned.txt
abort: git clone error 128 in s (in subrepo s)
[255]
$ f -Dq pwned.txt
pwned: you asked for it
+
+#endif