@@ -386,7 +386,7 @@ def test_clone_from_safe_options(self, rw_repo):
386386Repo .clone_from (rw_repo .common_dir ,destination ,multi_options = [option ])
387387assert destination .exists ()
388388
389- def test_clone_from_unsafe_procol (self ):
389+ def test_clone_from_unsafe_protocol (self ):
390390with tempfile .TemporaryDirectory ()as tdir :
391391tmp_dir = pathlib .Path (tdir )
392392tmp_file = tmp_dir / "pwn"
@@ -396,24 +396,49 @@ def test_clone_from_unsafe_procol(self):
396396 ]
397397for url in urls :
398398with self .assertRaises (UnsafeProtocolError ):
399- Repo .clone_from (url ,tmp_dir )
399+ Repo .clone_from (url ,tmp_dir / "repo" )
400400assert not tmp_file .exists ()
401401
402- def test_clone_from_unsafe_procol_allowed (self ):
402+ def test_clone_from_unsafe_protocol_allowed (self ):
403403with tempfile .TemporaryDirectory ()as tdir :
404404tmp_dir = pathlib .Path (tdir )
405405tmp_file = tmp_dir / "pwn"
406406urls = [
407- "ext::sh -c touch%/tmp/pwn " ,
407+ f "ext::sh -c touch%{ tmp_file }
408408"fd::/foo" ,
409409 ]
410410for url in urls :
411411# The URL will be allowed into the command, but the command will
412412# fail since we don't have that protocol enabled in the Git config file.
413413with self .assertRaises (GitCommandError ):
414- Repo .clone_from (url ,tmp_dir ,allow_unsafe_protocols = True )
414+ Repo .clone_from (url ,tmp_dir / "repo" ,allow_unsafe_protocols = True )
415415assert not tmp_file .exists ()
416416
417+ def test_clone_from_unsafe_protocol_allowed_and_enabled (self ):
418+ with tempfile .TemporaryDirectory ()as tdir :
419+ tmp_dir = pathlib .Path (tdir )
420+ tmp_file = tmp_dir / "pwn"
421+ urls = [
422+ f"ext::sh -c touch%{ tmp_file } ,
423+ ]
424+ allow_ext = [
425+ "--config=protocol.ext.allow=always" ,
426+ ]
427+ for url in urls :
428+ # The URL will be allowed into the command, and the protocol is enabled,
429+ # but the command will fail since it can't read from the remote repo.
430+ assert not tmp_file .exists ()
431+ with self .assertRaises (GitCommandError ):
432+ Repo .clone_from (
433+ url ,
434+ tmp_dir / "repo" ,
435+ multi_options = allow_ext ,
436+ allow_unsafe_protocols = True ,
437+ allow_unsafe_options = True ,
438+ )
439+ assert tmp_file .exists ()
440+ tmp_file .unlink ()
441+
417442@with_rw_repo ("HEAD" )
418443def test_max_chunk_size (self ,repo ):
419444class TestOutputStream (TestBase ):