+ associated adjustments in other files.
See cmdutil.restrict_file_access.__doc__ for an explanation of the
security hole this closes.
provide the following elements:
__desc__
A short string describing the purpose of your plugin
- execute(args)
+ execute(args, manipulate_encodings=True, restrict_file_access=False)
The entry function for your plugin. args is everything from
sys.argv after the name of your plugin (e.g. for the command
`be open abc', args=['abc']).
+ manipulate_encodings should be passed through to any calls to
+ bugdir.BugDir(). See the BugDir documentation for details.
+
+ If restrict_file_access==True, you should call
+ cmdutil.restrict_file_access(bugdir, path)
+ before attempting to read or write a file. See the
+ restrict_file_access documentation for details.
+
Note: be supports command-completion. To avoid raising errors you
need to deal with possible '--complete' options and arguments.
See the 'Command completion' section below for more information.
from libbe import cmdutil, bugdir
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os
>>> bd = bugdir.SimpleBugDir()
from libbe import cmdutil, bugdir
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> from libbe import bugdir
>>> import os
import sys
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import time
>>> bd = bugdir.SimpleBugDir()
import sys
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os
>>> from libbe import bug
elif options.body == "EDITOR":
body = editor.editor_string("Please enter your commit message above")
else:
+ if restrict_file_access == True:
+ cmdutil.restrict_file_access(bd, options.body)
body = bd.vcs.get_file_contents(options.body, allow_no_vcs=True)
try:
revision = bd.vcs.commit(summary, body=body,
self.blocking_bug = blocking_bug
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> from libbe import utility
>>> bd = bugdir.SimpleBugDir()
import os
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os
>>> bd = bugdir.SimpleBugDir()
sendmail='/usr/sbin/sendmail -t'
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os
>>> from libbe import bug
from libbe import cmdutil, utility
__desc__ = __doc__
-def execute(args, manipulate_encodings=False):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
Print help of specified command (the manipulate_encodings argument
is ignored).
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os
>>> bd = bugdir.SimpleBugDir()
from elementtree import ElementTree
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import time
>>> import StringIO
if filename == '-':
xml = sys.stdin.read()
else:
+ if restrict_file_access == True:
+ cmdutil.restrict_file_access(bd, options.body)
xml = bd.vcs.get_file_contents(filename, allow_no_vcs=True)
str_xml = xml.encode('unicode_escape').replace(r'\n', '\n')
# unicode read + encode to string so we know the encoding,
from libbe import cmdutil, bugdir
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> from libbe import utility, vcs
>>> import os
AVAILABLE_CMPS = [fn[4:] for fn in dir(bug) if fn[:4] == 'cmp_']
AVAILABLE_CMPS.remove("attr") # a cmp_* template.
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os
>>> bd = bugdir.SimpleBugDir()
import os, copy
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> from libbe import utility
>>> bd = bugdir.SimpleBugDir()
import sys
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os, time
>>> from libbe import bug
from libbe import cmdutil, bugdir
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os
>>> bd = bugdir.SimpleBugDir()
from libbe import cmdutil, bugdir
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> from libbe import mapfile
>>> import os
val = None
return str(val)
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os
>>> bd = bugdir.SimpleBugDir()
from libbe import cmdutil, bugdir, bug
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os
>>> bd = bugdir.SimpleBugDir()
from libbe import cmdutil, bugdir, comment, version, _version
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os
>>> bd = bugdir.SimpleBugDir()
from libbe import cmdutil, bugdir, bug
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os
>>> bd = bugdir.SimpleBugDir()
self.type_root = type_root
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> bd = bugdir.SimpleBugDir()
>>> bd.set_sync_with_disk(True)
import os, copy
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> from libbe import utility
>>> bd = bugdir.SimpleBugDir()
from libbe import cmdutil, bugdir
__desc__ = __doc__
-def execute(args, manipulate_encodings=True):
+def execute(args, manipulate_encodings=True, restrict_file_access=False):
"""
>>> import os
>>> bd = bugdir.SimpleBugDir()
os.chdir(BE_DIR)
try:
self.ret = libbe.cmdutil.execute(self.command, self.args,
- manipulate_encodings=False)
+ manipulate_encodings=False,
+ restrict_file_access=True)
except libbe.cmdutil.GetHelp:
print libbe.cmdutil.help(command)
except libbe.cmdutil.GetCompletions:
return cmd
-def execute(cmd, args, manipulate_encodings=True):
+def execute(cmd, args, manipulate_encodings=True, restrict_file_access=False):
enc = encoding.get_encoding()
cmd = get_command(cmd)
ret = cmd.execute([a.decode(enc) for a in args],
- manipulate_encodings=manipulate_encodings)
+ manipulate_encodings=manipulate_encodings,
+ restrict_file_access=restrict_file_access)
if ret == None:
ret = 0
return ret
return "%s\n%s" % (instring, "="*len(instring))
+def restrict_file_access(bugdir, path):
+ """
+ Check that the file at path is inside bugdir.root. This is
+ important if you allow other users to execute becommands with your
+ username (e.g. if you're running be-handle-mail through your
+ ~/.procmailrc). If this check wasn't made, a user could e.g.
+ run
+ be commit -b ~/.ssh/id_rsa "Hack to expose ssh key"
+ which would expose your ssh key to anyone who could read the VCS
+ log.
+ """
+ in_root = bugdir.vcs.path_in_root(path, bugdir.root)
+ if in_root == False:
+ raise UserError('file access restricted!\n %s not in %s'
+ % (path, bugdir.root))
+
def parse_id(id):
"""
Return (bug_id, comment_id) tuple.
projects / be.git / commitdiff