HISTORY.md

@@ -2,6 +2,21 @@
 
 History is important, but our current roadmap can be found [here](https://github.com/cookiecutter/cookiecutter/projects)
 
+## 2.1.1 (2022-06-01)
+
+### Documentation updates
+
+* Fix local extensions documentation (#1686) @alkatar21
+
+### Bugfixes
+
+* Sanitize Mercurial branch information before checkout. (#1689) @ericof
+
+### This release is made by wonderfull contributors:
+
+@alkatar21, @ericof and @jensens
+
+
 ## 2.1.0 (2022-05-30)
 
 ### Changes

cookiecutter/__init__.py

@@ -1,2 +1,2 @@
 """Main package for Cookiecutter."""
-__version__ = "2.1.0"
+__version__ = "2.1.1"

cookiecutter/vcs.py

@@ -98,22 +98,26 @@ def clone(repo_url, checkout=None, clone_to_dir='.', no_input=False):
                 stderr=subprocess.STDOUT,
             )
             if checkout is not None:
+                checkout_params = [checkout]
+                # Avoid Mercurial "--config" and "--debugger" injection vulnerability
+                if repo_type == "hg":
+                    checkout_params.insert(0, "--")
                 subprocess.check_output(  # nosec
-                    [repo_type, 'checkout', checkout],
+                    [repo_type, 'checkout', *checkout_params],
                     cwd=repo_dir,
                     stderr=subprocess.STDOUT,
                 )
         except subprocess.CalledProcessError as clone_error:
             output = clone_error.output.decode('utf-8')
             if 'not found' in output.lower():
                 raise RepositoryNotFound(
-                    'The repository {} could not be found, '
-                    'have you made a typo?'.format(repo_url)
+                    f'The repository {repo_url} could not be found, '
+                    'have you made a typo?'
                 )
             if any(error in output for error in BRANCH_ERRORS):
                 raise RepositoryCloneFailed(
-                    'The {} branch of repository {} could not found, '
-                    'have you made a typo?'.format(checkout, repo_url)
+                    f'The {checkout} branch of repository '
+                    f'{repo_url} could not found, have you made a typo?'
                 )
             logger.error('git clone failed with error: %s', output)
             raise

docs/advanced/local_extensions.rst

@@ -3,7 +3,7 @@
 Local Extensions
 ----------------
 
-*New in Cookiecutter X.x*
+*New in Cookiecutter 2.1*
 
 A template may extend the Cookiecutter environment with local extensions.
 These can be part of the template itself, providing it with more sophisticated custom tags and filters.
@@ -18,13 +18,10 @@ To do so, a template author must specify the required extensions in ``cookiecutt
         "_extensions": ["local_extensions.FoobarExtension"]
     }
 
-This example assumes that a ``local_extensions`` folder (python module) exists in the template root.
-It will contain a ``main.py`` file, containing the following (for instance):
+This example uses a simple module ``local_extensions.py`` which exists in the template root, containing the following (for instance):
 
 .. code-block:: python
 
-    # -*- coding: utf-8 -*-
-
     from jinja2.ext import Extension
 
 
@@ -48,8 +45,6 @@ It's likely that we'd only want to register a single function as a filter. For t
 
 .. code-block:: python
 
-    # -*- coding: utf-8 -*-
-
     from cookiecutter.utils import simple_filter
 
 
@@ -58,3 +53,7 @@ It's likely that we'd only want to register a single function as a filter. For t
         return v * 2
 
 This snippet will achieve the exact same result as the previous one.
+
+For complex use cases, a python module ``local_extensions`` (a folder with an ``__init__.py``) can also be created in the template root.
+Here, for example, a module ``main.py`` would have to export all extensions with ``from .main import FoobarExtension, simplefilterextension`` or ``from .main import *`` in the ``__init__.py``.
+

setup.py

@@ -2,7 +2,7 @@
 """cookiecutter distutils configuration."""
 from setuptools import setup
 
-version = "2.1.0"
+version = "2.1.1"
 
 with open('README.md', encoding='utf-8') as readme_file:
     readme = readme_file.read()

tests/vcs/test_clone.py

@@ -122,8 +122,16 @@ def test_clone_should_invoke_vcs_command(
     mock_subprocess.assert_any_call(
         [repo_type, 'clone', repo_url], cwd=str(clone_dir), stderr=subprocess.STDOUT
     )
+
+    branch_info = [branch]
+    # We sanitize branch information for Mercurial
+    if repo_type == "hg":
+        branch_info.insert(0, "--")
+
     mock_subprocess.assert_any_call(
-        [repo_type, 'checkout', branch], cwd=expected_repo_dir, stderr=subprocess.STDOUT
+        [repo_type, 'checkout', *branch_info],
+        cwd=expected_repo_dir,
+        stderr=subprocess.STDOUT,
     )
 
 
@@ -151,8 +159,8 @@ def test_clone_handles_repo_typo(mocker, clone_dir, error_message):
         vcs.clone(repository_url, clone_to_dir=str(clone_dir), no_input=True)
 
     assert str(err.value) == (
-        'The repository {} could not be found, have you made a typo?'
-    ).format(repository_url)
+        f'The repository {repository_url} could not be found, have you made a typo?'
+    )
 
 
 @pytest.mark.parametrize(
@@ -182,8 +190,8 @@ def test_clone_handles_branch_typo(mocker, clone_dir, error_message):
 
     assert str(err.value) == (
         'The unknown_branch branch of repository '
-        '{} could not found, have you made a typo?'
-    ).format(repository_url)
+        f'{repository_url} could not found, have you made a typo?'
+    )
 
 
 def test_clone_unknown_subprocess_error(mocker, clone_dir):