166 lines
6 KiB
Diff
166 lines
6 KiB
Diff
From e368a2ee9db863112dcd5054a8db439ea07c8ae9 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?St=C3=A9phane=20Bidoul?= <stephane.bidoul@gmail.com>
|
|
Date: Mon, 29 May 2023 13:57:52 +0200
|
|
Subject: [PATCH 1/4] Pass revisions options explicitly to mercurial commands
|
|
|
|
---
|
|
news/12119.bugfix.rst | 3 +++
|
|
src/pip/_internal/vcs/mercurial.py | 2 +-
|
|
tests/unit/test_vcs.py | 2 +-
|
|
3 files changed, 5 insertions(+), 2 deletions(-)
|
|
create mode 100644 news/12119.bugfix.rst
|
|
|
|
diff --git a/news/12119.bugfix.rst b/news/12119.bugfix.rst
|
|
new file mode 100644
|
|
index 0000000..da8d8b0
|
|
--- /dev/null
|
|
+++ b/news/12119.bugfix.rst
|
|
@@ -0,0 +1,3 @@
|
|
+Pass the ``-r`` flag to mercurial to be explicit that a revision is passed and protect
|
|
+against ``hg`` options injection as part of VCS URLs. Users that do not have control on
|
|
+VCS URLs passed to pip are advised to upgrade.
|
|
diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py
|
|
index 2a005e0..4595960 100644
|
|
--- a/src/pip/_internal/vcs/mercurial.py
|
|
+++ b/src/pip/_internal/vcs/mercurial.py
|
|
@@ -31,7 +31,7 @@ class Mercurial(VersionControl):
|
|
|
|
@staticmethod
|
|
def get_base_rev_args(rev: str) -> List[str]:
|
|
- return [rev]
|
|
+ return ["-r", rev]
|
|
|
|
def fetch_new(
|
|
self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int
|
|
diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py
|
|
index 566c88c..38daaa0 100644
|
|
--- a/tests/unit/test_vcs.py
|
|
+++ b/tests/unit/test_vcs.py
|
|
@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None:
|
|
# First check VCS-specific RevOptions behavior.
|
|
(Bazaar, [], ["-r", "123"], {}),
|
|
(Git, ["HEAD"], ["123"], {}),
|
|
- (Mercurial, [], ["123"], {}),
|
|
+ (Mercurial, [], ["-r", "123"], {}),
|
|
(Subversion, [], ["-r", "123"], {}),
|
|
# Test extra_args. For this, test using a single VersionControl class.
|
|
(
|
|
--
|
|
2.44.0
|
|
|
|
|
|
From 29f1379a6ebcf48dae94d4446c568edac6a86372 Mon Sep 17 00:00:00 2001
|
|
From: Pradyun Gedam <pradyunsg@users.noreply.github.com>
|
|
Date: Sun, 1 Oct 2023 14:10:25 +0100
|
|
Subject: [PATCH 2/4] Use `-r=...` instead of `-r ...` for hg
|
|
|
|
This ensures that the resulting revision can not be misinterpreted as an
|
|
option.
|
|
---
|
|
src/pip/_internal/vcs/mercurial.py | 2 +-
|
|
tests/unit/test_vcs.py | 2 +-
|
|
2 files changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py
|
|
index 4595960..e440c12 100644
|
|
--- a/src/pip/_internal/vcs/mercurial.py
|
|
+++ b/src/pip/_internal/vcs/mercurial.py
|
|
@@ -31,7 +31,7 @@ class Mercurial(VersionControl):
|
|
|
|
@staticmethod
|
|
def get_base_rev_args(rev: str) -> List[str]:
|
|
- return ["-r", rev]
|
|
+ return [f"-r={rev}"]
|
|
|
|
def fetch_new(
|
|
self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int
|
|
diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py
|
|
index 38daaa0..9afd022 100644
|
|
--- a/tests/unit/test_vcs.py
|
|
+++ b/tests/unit/test_vcs.py
|
|
@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None:
|
|
# First check VCS-specific RevOptions behavior.
|
|
(Bazaar, [], ["-r", "123"], {}),
|
|
(Git, ["HEAD"], ["123"], {}),
|
|
- (Mercurial, [], ["-r", "123"], {}),
|
|
+ (Mercurial, [], ["-r=123"], {}),
|
|
(Subversion, [], ["-r", "123"], {}),
|
|
# Test extra_args. For this, test using a single VersionControl class.
|
|
(
|
|
--
|
|
2.44.0
|
|
|
|
|
|
From 19db9b777831cb3da519bc84304501b7b9702159 Mon Sep 17 00:00:00 2001
|
|
From: Pradyun Gedam <pradyunsg@users.noreply.github.com>
|
|
Date: Sun, 1 Oct 2023 13:49:06 +0100
|
|
Subject: [PATCH 3/4] newspaper:
|
|
|
|
---
|
|
news/12306.bugfix.rst | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
create mode 100644 news/12306.bugfix.rst
|
|
|
|
diff --git a/news/12306.bugfix.rst b/news/12306.bugfix.rst
|
|
new file mode 100644
|
|
index 0000000..eb6eeca
|
|
--- /dev/null
|
|
+++ b/news/12306.bugfix.rst
|
|
@@ -0,0 +1 @@
|
|
+Use ``-r=...`` instead of ``-r ...`` to specify references with Mercurial.
|
|
--
|
|
2.44.0
|
|
|
|
|
|
From 259d59335885077c1e1adbed02986734e2823f27 Mon Sep 17 00:00:00 2001
|
|
From: efflamlemaillet <6533295+efflamlemaillet@users.noreply.github.com>
|
|
Date: Fri, 27 Oct 2023 11:08:17 +0200
|
|
Subject: [PATCH 4/4] Fix hg: "parse error at 0: not a prefix:" (#12373)
|
|
|
|
Use two hypen argument `--rev=` instead of `-r=`
|
|
|
|
Co-authored-by: Efflam Lemaillet <elemaillet@logilab.fr>
|
|
Co-authored-by: Pradyun Gedam <pradyunsg@gmail.com>
|
|
---
|
|
news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst | 1 +
|
|
src/pip/_internal/vcs/mercurial.py | 2 +-
|
|
tests/unit/test_vcs.py | 2 +-
|
|
3 files changed, 3 insertions(+), 2 deletions(-)
|
|
create mode 100644 news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst
|
|
|
|
diff --git a/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst b/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst
|
|
new file mode 100644
|
|
index 0000000..76a8e6b
|
|
--- /dev/null
|
|
+++ b/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst
|
|
@@ -0,0 +1 @@
|
|
+Fix mercurial revision "parse error": use ``--rev={ref}`` instead of ``-r={ref}``
|
|
diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py
|
|
index e440c12..c183d41 100644
|
|
--- a/src/pip/_internal/vcs/mercurial.py
|
|
+++ b/src/pip/_internal/vcs/mercurial.py
|
|
@@ -31,7 +31,7 @@ class Mercurial(VersionControl):
|
|
|
|
@staticmethod
|
|
def get_base_rev_args(rev: str) -> List[str]:
|
|
- return [f"-r={rev}"]
|
|
+ return [f"--rev={rev}"]
|
|
|
|
def fetch_new(
|
|
self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int
|
|
diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py
|
|
index 9afd022..8512357 100644
|
|
--- a/tests/unit/test_vcs.py
|
|
+++ b/tests/unit/test_vcs.py
|
|
@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None:
|
|
# First check VCS-specific RevOptions behavior.
|
|
(Bazaar, [], ["-r", "123"], {}),
|
|
(Git, ["HEAD"], ["123"], {}),
|
|
- (Mercurial, [], ["-r=123"], {}),
|
|
+ (Mercurial, [], ["--rev=123"], {}),
|
|
(Subversion, [], ["-r", "123"], {}),
|
|
# Test extra_args. For this, test using a single VersionControl class.
|
|
(
|
|
--
|
|
2.44.0
|
|
|