Patchwork D1136: templatefilters: defend against evil unicode strs in json filter

login
register
mail settings
Submitter phabricator
Date Oct. 17, 2017, 2:26 p.m.
Message ID <2e9b0df610a5b773bf6af2aab7312eba@localhost.localdomain>
Download mbox | patch
Permalink /patch/25103/
State Not Applicable
Headers show

Comments

phabricator - Oct. 17, 2017, 2:26 p.m.
durin42 updated this revision to Diff 2917.

REPOSITORY
  rHG Mercurial

CHANGES SINCE LAST UPDATE
  https://phab.mercurial-scm.org/D1136?vs=2886&id=2917

REVISION DETAIL
  https://phab.mercurial-scm.org/D1136

AFFECTED FILES
  mercurial/templatefilters.py

CHANGE DETAILS




To: durin42, #hg-reviewers, yuja
Cc: yuja, ryanmce, mercurial-devel

Patch

diff --git a/mercurial/templatefilters.py b/mercurial/templatefilters.py
--- a/mercurial/templatefilters.py
+++ b/mercurial/templatefilters.py
@@ -233,6 +233,13 @@ 
         return pycompat.bytestr(obj)
     elif isinstance(obj, bytes):
         return '"%s"' % encoding.jsonescape(obj, paranoid=paranoid)
+    elif isinstance(obj, str):
+        # This branch is unreachable on Python 2, because bytes == str
+        # and we'll return in the next-earlier block in the elif
+        # ladder. On Python 3, this helps us catch bugs before they
+        # hurt someone.
+        raise error.ProgrammingError(
+            r'Mercurial only does output with bytes on Python 3: %r' % obj)
     elif util.safehasattr(obj, 'keys'):
         out = ['"%s": %s' % (encoding.jsonescape(k, paranoid=paranoid),
                              json(v, paranoid))