> On Fri, Jan 6, 2012 at 10:16 PM, Matt Mackall <
[hidden email]> wrote:
> > On Fri, 2012-01-06 at 13:49 +0100, Jeroen De Vlieger wrote:
> >> Hi,
> >>
> >> I recently learned of the nice symlink behaviour in rsync, more
> >> specifically the distinction between safe and unsafe symlinks.
> >>
> >> > Symbolic links are considered unsafe if they are :
> >> > absolute symlinks (start with /),
> >> > empty, or
> >> > if they contain enough “..” components to ascend from the directory
> >> being copied.
> >>
> >>
> >> Does mercurial also support a similar notion of safe and unsafe symlinks?
> >> I.e. symlink that point to files not in the repository?
> >
> > No, we support a completely different notion of safe and unsafe links.
> >
> > First, consider that the primary purpose of Mercurial is to distribute
> > source code across the internet. If you -run- untrusted source code, any
> > security measure we could possibly create is instantly irrelevant. Once
> > you type 'make', it's game over.
> >
> > So that limits Mercurial's security scope to things like allowing users
> > to safely check out and inspect code before running it. For instance, we
> > take care to avoid traversing symlinks when checking out files, as that
> > could allow a hostile repo to install hostile hooks on checkout.
> >
> > Here's the core of our path auditing rules:
> >
> >
http://www.selenic.com/hg/file/f15c646bffc7/mercurial/scmutil.py#l61>
> Thanks for the fast response,
>
> Would it make sense to print a 'warning' if the user tries to add a
> symlink that doesn't point to a file in the same repo?
>
> I would argue that is would help to keep your project local. meaning
> that a simple archive would actually contain the complete working
> project. Which is not the case if you'r project contains symlinks to
> external files. It *would* make sense for my -admittedly small-
> personal projects. I don't really have a lot experience with large
> scale projects with lots of contributors though :-s
Probably not. There are no doubt tons of people using symlinks outside
/etc directories.
Mathematics is the supreme nostalgia of our time.