mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: reject Git diff driver helpers

Browse Source
This commit is contained in:
marcopan
2026-08-10 00:30:06 +02:00
parent e042692cae
commit c10857405a
2 changed files with 40 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/scripts/p1-acceptance.mjs
+9 -5
View File
@@ -555,11 +555,15 @@ function rawGitConfigEntries(path, required = false) {
if (!entry.isFile() || entry.isSymbolicLink()) throw new Error("unsafe Git repository state: local config is unsafe");
return parseLocalGitConfig(readFileSync(path, "utf8"));
}
function unsafeRawGitConfigKey(key) {
function unsafeRawGitConfigKey(key, value = "") {
const normalized = key.toLowerCase();
return /^filter\..+\.(?:clean|smudge|process|required)$/.test(normalized)
|| /^remote\..+\.(?:uploadpack|receivepack)$/.test(normalized)
|| /^(?:core\.(?:hookspath|attributesfile)|diff\.external|interactive\.difffilter)$/.test(normalized)
if (normalized === "core.fsmonitor" && /^(?:true|false|1|0)$/i.test(String(value).trim())) return false;
return /^(?:filter|diff)\..+\.(?:clean|smudge|process|required|textconv|external|command)$/.test(normalized)
|| /^(?:remote\..+\.(?:uploadpack|receivepack)|uploadpack\..+|receivepack\..+)$/.test(normalized)
|| /^credential(?:\..+)?\.helper$/.test(normalized)
|| /^(?:core\.(?:hookspath|attributesfile|fsmonitor|sshcommand|askpass|pager|editor|sequence\.editor)|sequence\.editor|interactive\.difffilter|diff\.external|gpg\.program|gpg\.ssh\.program)$/.test(normalized)
|| /^merge\..+\.driver$/.test(normalized)
|| /^(?:pager\..+|alias\..+|difftool\..+\.(?:cmd|path)|mergetool\..+\.(?:cmd|path))$/.test(normalized)
|| /^include(?:if\..+)?\.path$/.test(normalized);
}
function validateRawGitDirectoryState(gitDirectory) {
@@ -568,7 +572,7 @@ function validateRawGitDirectoryState(gitDirectory) {
...rawGitConfigEntries(join(common, "config"), true),
...rawGitConfigEntries(join(gitDirectory, "config.worktree")),
];
if (entries.some(([key]) => unsafeRawGitConfigKey(key))) {
if (entries.some(([key, value]) => unsafeRawGitConfigKey(key, value))) {
throw new Error("unsafe Git repository state: executable local config is present");
}
for (const hooks of new Set([join(common, "hooks"), join(gitDirectory, "hooks")])) {