Reject option-like VCS arguments a separator can't guard - #552
Merged
Conversation
git pull re-invokes git fetch without an end-of-options --, so the separator libvcs places before pull's positionals never reached the child fetch. A repository or reftag beginning with - was parsed there as an option; --upload-pack=<cmd> ran an arbitrary command. Reject a - prefix in both positions via a shared reject_option_like() helper in _internal/run, raising LibVCSException before the command is built. A regression test drives the injection through the real Git.pull API and asserts the canary is never created.
A configured rev flowed into git rev-list <commit>, which places the operand with no end-of-options --. A rev of --output=<file> was parsed there as git's diff --output option, truncating the file during option parsing -- file destruction from a config-supplied revision. Validate rev with reject_option_like() before use and record a "rev" SyncResult error instead of running the command. A regression test drives a malicious rev through update_repo and asserts the victim file is left intact.
svn checkout takes the URL as its first positional with no end-of-options separator, so a URL beginning with - was parsed as an option; svn's --config-option can set a tunnel command, an execution primitive. Reject a - prefix via reject_option_like(), matching the protection the git and hg clone paths already carry. relocate() and switch() are unaffected: they convert a non-file:// target through pathlib as_uri(), so the value can never reach argv option-like.
Assert git clone emits -- immediately before the URL. This was the only git-side separator with no test; a refactor dropping it would else pass, because the single-positional clone shape never runs the injected --upload-pack helper, making an end-to-end canary test vacuous here (unlike the hg alias path, whose regression test does execute).
Regenerated as a single CHANGES-only commit: the guards for Git.pull, GitSync rev, and Svn.checkout, crediting the report that prompted the audit. The entries were previously entangled in the three fix commits.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #552 +/- ##
==========================================
+ Coverage 61.34% 61.50% +0.15%
==========================================
Files 40 40
Lines 6556 6595 +39
Branches 1104 1106 +2
==========================================
+ Hits 4022 4056 +34
- Misses 1940 1946 +6
+ Partials 594 593 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Git.pull()executed an arbitrary command whenrepository/reftagbegan with-:git pullre-invokesgit fetchwithout an end-of-options--, so--upload-pack=<cmd>reached the child fetch as an option. It now raisesLibVCSException.GitSync(rev=...)truncated an arbitrary file when the configured revision began with-: the value reachedgit rev-list <commit>, where--output=<file>is a diff option that opens the file for writing during option parsing.update_repo()now records areverror instead of running the command.Svn.checkout(url=...)rejects a URL beginning with-; svn's--config-optioncan set a tunnel command. This matches the protection the git and hg clone paths already carry.--separator ahead of the git clone URL, the one git-side separator no test covered.reject_option_like()guard in_internal/run.py, applied where an end-of-options--cannot neutralize an option-like value.Design decisions
--, where the separator can't protect —git pullre-spawnsgit fetchwith no separator, arevafter--is read as a pathspec (git 2.44+ needed for--end-of-options), and svn'srun()appends global options after the subcommand args so a--would swallow them. A leading--guard is the only fix that holds in all three; the working--separators on clone/fetch/hg are left untouched.Git.pull()API, so the guard sits incmd/; therevvector enters via config throughGitSync, so that guard sits insync/and surfaces as aSyncResulterror rather than an exception.Test plan
uv run pytest— full suite plus doctests (doctest flags live inpyproject.toml)uv run ruff format . --checkanduv run ruff check .uv run mypy .test_pull_rejects_option_like_repository— drives the injection through the realGit.pull()API and asserts no command runstest_update_repo_rejects_option_like_rev— asserts a victim file is left intacttest_checkout_rejects_option_like_url— rejects an option-like svn URLtest_clone_places_end_of_options_before_url— pins--before the clone URL (proven to fail if the separator is dropped)Verification