I'm setting up a small code-hosting web site, in the vein of github or bitbucket. I would like to allow users to specify an arbitrary URL from which my site's server will initially clone their repository. I'm using mercurial, so cloning essentially just means negotiating a simple HTTP-based protocol between the client (my server in this case) and the host (the URL that the user has provided).
I don't know all of the details of the mercurial protocol, but it involves making some GET and POST HTTP requests, and specifying some query parameters on the user-provided URL. Other than the URL the user should not have any control over what requests are sent from my site to the URL they specify.
If successful, the interaction with the provided URL will produce a set of files, which will be served from my site, possibly to other users, but not directly, with the exception of images. In other words, if it's an image file, I will serve it, but otherwise it will only be viewable as escaped text.