First experience with "hgsubversion" extension

[Augie Fackler]

> On May 21, 2018, at 7:20 AM, Dr Rainer Woitok <rainer.woitok at gmail.com> wrote:
> 
> Augie,
> 
> On Saturday, 2018-05-19 21:44:04 -0400, you wrote:
> 
>> ...
>>>  [subrepos]
>>>  hgsubversion:allowed = true
>>> ...
>>> Question: Couldn't this also be done automatically by the "hgsubversion"
>>> extension?
>> 
>> It could, but it would be at risk of presenting a security vulnerability. We had a really frustrating security release a while back because of the ability to sneak shell commands in subrepo URLs. :(
> 
> Am I correct  in assuming that  the solution to this problem  was to set
> "hgsubversion:allowed" to false by default?   What should I look out for
> before I  enable that option?   Is it sufficient  to just look into file
> ".hgsub" or may the malicious stuff be hidden on the remote server?

The .hgsub is where the problem could occur. As long as you’re cloning repositories you trust, you’ll be fine.

> 
>> ...
>>> Oh, and "hg help svn" only returns
>>> 
>>>  hg svn <subcommand> ...
>>> 
>>>  (no help text available)
>>> 
>>>  options:
>>> 
>>> followed by terse descriptions of a few options.
>> 
>> Sigh. That could be fixed, maybe file a bug in hgsubversion’s bug tracker so it doesn’t get lost?
> 
> Done :-)
> 
> Sincerely,
>  Rainer