prevent out-of-repo access when manipulating references. - #2134
Conversation
Sorry, something went wrong.
This previously made it possible to create, modify and delete files outside outside of the repository, which is a problem if inputs aren't trusted. Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
There was a problem hiding this comment.
Pull request overview
This PR hardens ref/reflog filesystem path handling to prevent path traversal and other escapes that could otherwise write, rename, or delete files outside the repository’s git directories when ref inputs are untrusted.
Changes:
- Add validated path resolution (realpath + commonpath) for ref and reflog paths to ensure they stay within the repo’s git/common dirs.
- Use validated ref paths in SymbolicReference operations (create/set/delete/rename) and in RemoteReference.delete.
- Add regression tests to ensure path traversal attempts are rejected.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| git/refs/symbolic.py | Introduces validated path helpers and applies them to ref file operations. |
| git/refs/remote.py | Validates remote ref paths and uses validated filesystem paths when deleting ref files. |
| git/refs/log.py | Uses validated reflog path construction. |
| test/test_refs.py | Adds regression tests ensuring path traversal is rejected for various ref operations. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sorry, something went wrong.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sorry, something went wrong.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sorry, something went wrong.
|
On Byron's behalf: Review pass on the latest Copilot comments:
|
Sorry, something went wrong.
Consolidate follow-up fixes from review and CI: - fix lint and mypy issues in reference log path handling - validate remote reference paths before invoking git branch deletion - add symlink escape coverage where realpath resolves symlinks - ensure temporary test repositories release git resources during cleanup Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
This previously made it possible to create, modify and delete files outside outside of the repository, which is a problem if inputs aren't trusted.
Tasks