Block unsafe archive additions and bundle URI · gitpython-developers/GitPython@7a4f5dc · GitHub

gitpython-developers / GitPython Public

• Notifications You must be signed in to change notification settings
• Fork 989
• Star 5.2k

• Code
• Issues 8
• Pull requests 2
• Discussions
• Actions
• Security and quality 34
• Insights

Additional navigation options

Commit 7a4f5dc

Browse filesBrowse the repository at this point in the historyBrowse files

codex

and

Byron

committed

Block unsafe archive additions and bundle URI

GHSA-539m-9xh6-q6rr reports incomplete unsafe option lists for archive inputs and clone bundle URLs. Caller-controlled archive additions can expose or inject filesystem content, while clone --bundle-uri can dereference an additional caller-controlled URL. Extend the existing archive denylist with --add-file and --add-virtual-file, and the clone denylist with --bundle-uri. Regression coverage exercises archive kwargs plus both clone multi-option and keyword paths. Git baseline: a23bace963d508bd96983cc637131392d3face18. Documentation/git-archive.adoc defines --add-file/--add-virtual-file, and Documentation/git-clone.adoc defines --bundle-uri as fetching from the supplied URI. Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>

1 parent 3af0c25 commit 7a4f5dc
Copy full SHA for 7a4f5dc

3 files changed

+12Lines changed: 12 additions & 0 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• git/repo
  • base.py
• test
  • test_clone.py
  • test_repo.py

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎git/repo/base.py‎

Copy file name to clipboardExpand all lines: git/repo/base.py

+6Lines changed: 6 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -151,6 +151,8 @@ class Repo:
151	151	"-c",
152	152	# Can install hooks that execute during clone:
153	153	"--template",
	154	+ # Fetches from a caller-controlled URL:
	155	+ "--bundle-uri",
154	156	]
155	157	"""Options to :manpage:`git-clone(1)` that allow arbitrary commands to be executed.
156	158
@@ -172,6 +174,10 @@ class Repo:
172	174	# Writes output to a caller-controlled filesystem path.
173	175	"--output",
174	176	"-o",
	177	+ # Reads from a caller-controlled filesystem path:
	178	+ "--add-file",
	179	+ # Injects a caller-controlled path and contents:
	180	+ "--add-virtual-file",
175	181	]
176	182
177	183	unsafe_git_revision_options = [

Collapse file

‎test/test_clone.py‎

Copy file name to clipboardExpand all lines: test/test_clone.py

+2Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -132,6 +132,7 @@ def test_clone_unsafe_options(self, rw_repo):
132	132	"-cprotocol.ext.allow=always",
133	133	"-vcprotocol.ext.allow=always",
134	134	f"--template={tmp_dir}",
	135	+ f"--bundle-uri=file://{tmp_dir}",
135	136	]
136	137	for unsafe_option in unsafe_options:
137	138	with self.assertRaises(UnsafeOptionError):
@@ -147,6 +148,7 @@ def test_clone_unsafe_options(self, rw_repo):
147	148	{"conf": "protocol.ext.allow=always"},
148	149	{"c": "protocol.ext.allow=always"},
149	150	{"template": tmp_dir},
	151	+ {"bundle_uri": f"file://{tmp_dir}"},
150	152	]
151	153	for unsafe_option in unsafe_options:
152	154	with self.assertRaises(UnsafeOptionError):

Collapse file

‎test/test_repo.py‎

Copy file name to clipboardExpand all lines: test/test_repo.py

+4Lines changed: 4 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -433,6 +433,10 @@ def test_archive_rejects_unsafe_options(self):
433	433	with self.assertRaises(UnsafeOptionError):
434	434	self.rorepo.archive(io.BytesIO(), "0.1.6", output=output_marker)
435	435	assert not osp.exists(output_marker)
	436	+ with self.assertRaises(UnsafeOptionError):
	437	+ self.rorepo.archive(io.BytesIO(), "0.1.6", add_file=output_marker)
	438	+ with self.assertRaises(UnsafeOptionError):
	439	+ self.rorepo.archive(io.BytesIO(), "0.1.6", add_virtual_file="file:content")
436	440
437	441	def test_archive_rejects_unsafe_remote_protocol(self):
438	442	with tempfile.TemporaryDirectory() as tdir:

0 commit comments

Comments

0 (0)