Pass SSH wrappers to VCS commands unconditonally, not just if there's an SSH remote

Summary:
Ref T12961. In Mercurial, it's possible to have "subrepos" which may use a different protocol than the main repository.

By putting an SSH repository inside an HTTP repository, an attacker can theoretically get us to execute `hg` without overriding `ui.ssh`, then execute code via the SSH hostname attack.

As an immediate mitigation to this attack, specify `ui.ssh` unconditionally. Normally, this will have no effect (it will just be ignored). In the specific case of an SSH repo inside an HTTP repo, it will defuse the `ssh` protocol.

For good measure and consistency, do the same for Subversion and Git. However, we don't normally maintain working copies for either Subversion or Git so it's unlikely that similar attacks exist there.

Test Plan:
  - Put an SSH subrepo with an attack URI inside an HTTP outer repo in Mercurial.
  - Ran `hg up` with and without `ui.ssh` specified.
  - Got dangerous badness without `ui.ssh` and safe `ssh` subprocesses with `ui.ssh`.

I'm not yet able to confirm that `hg pull -u -- <uri>` can actually trigger this, but this can't hurt and our SSH wrapper is safer than the native behavior for all Subversion, Git and Mercurial versions released prior to today.

Reviewers: chad

Reviewed By: chad

Subscribers: cspeckmim

Maniphest Tasks: T12961

Differential Revision: https://secure.phabricator.com/D18389

src/applications/diffusion/protocol/DiffusionGitCommandEngine.php

@@ -26,9 +26,7 @@ final class DiffusionGitCommandEngine
 
     $env['HOME'] = PhabricatorEnv::getEmptyCWD();
 
-    if ($this->isAnySSHProtocol()) {
+    $env['GIT_SSH'] = $this->getSSHWrapper();
-      $env['GIT_SSH'] = $this->getSSHWrapper();
-    }
 
     if ($this->isAnyHTTPProtocol()) {
       $uri = $this->getURI();

src/applications/diffusion/protocol/DiffusionMercurialCommandEngine.php

@@ -11,12 +11,14 @@ final class DiffusionMercurialCommandEngine
   protected function newFormattedCommand($pattern, array $argv) {
     $args = array();
 
-    if ($this->isAnySSHProtocol()) {
+    // NOTE: Here, and in Git and Subversion, we override the SSH command even
-      $pattern = "hg --config ui.ssh=%s {$pattern}";
+    // if the repository does not use an SSH remote, since our SSH wrapper
-      $args[] = $this->getSSHWrapper();
+    // defuses an attack against older versions of Mercurial, Git and
-    } else {
+    // Subversion (see T12961) and it's possible to execute this attack
-      $pattern = "hg {$pattern}";
+    // in indirect ways, like by using an SSH subrepo inside an HTTP repo.
-    }
+
+    $pattern = "hg --config ui.ssh=%s {$pattern}";
+    $args[] = $this->getSSHWrapper();
 
     return array($pattern, array_merge($args, $argv));
   }

src/applications/diffusion/protocol/DiffusionSubversionCommandEngine.php

@@ -44,9 +44,7 @@ final class DiffusionSubversionCommandEngine
   protected function newCustomEnvironment() {
     $env = array();
 
-    if ($this->isAnySSHProtocol()) {
+    $env['SVN_SSH'] = $this->getSSHWrapper();
-      $env['SVN_SSH'] = $this->getSSHWrapper();
-    }
 
     return $env;
   }

src/applications/diffusion/protocol/__tests__/DiffusionCommandEngineTestCase.php

@@ -26,7 +26,7 @@ final class DiffusionCommandEngineTestCase extends PhabricatorTestCase {
       ));
 
     $this->assertCommandEngineFormat(
-      'hg xyz',
+      (string)csprintf('hg --config ui.ssh=%s xyz', $ssh_wrapper),
       array(
         'LANG' => 'en_US.UTF-8',
         'HGPLAIN' => '1',
@@ -102,7 +102,7 @@ final class DiffusionCommandEngineTestCase extends PhabricatorTestCase {
       ));
 
     $this->assertCommandEngineFormat(
-      'hg xyz',
+      (string)csprintf('hg --config ui.ssh=%s xyz', $ssh_wrapper),
       array(
         'LANG' => 'en_US.UTF-8',
         'HGPLAIN' => '1',