IJHack / QtPass / 41284697913

93%

push

github

Git pin: honour safe.directory for a store another user owns (#2102)

* Git pin: honour safe.directory for a store another user owns

When the store's parent path holds git's list separator, QtPass pins
GIT_DIR to the store's own .git, which skips git's ownership check; on
Unix it therefore repeats that check and refuses another user's store.
It did not consult safe.directory, so such a store got no Git even when
the user trusted it that way.

Read safe.directory as git does, only for a store that is not the user's
own: from system, global and command-line configuration (never the
repository's own, which cannot vouch for itself; the query runs with a
GIT_DIR that cannot exist and keeps only those scopes), in order. "*"
trusts every repository, an empty value forgets the entries before it, a
path ending in "/*" trusts what lies below it, any other absolute path
trusts that one folder after resolving links; relative entries and paths
that do not exist trust nothing.

tst_util's git config is isolated now, so the user's own safe.directory
cannot trust the stores the tests hand to another user.

Tracked in #2094.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* SECURITY: keep the Git pin bullet under the line limit

Move the note on where safe.directory counts into the next bullet; the
first one ran to 451 characters (MD013 allows 400).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* Git pin: leave GIT_CONFIG out of the safe.directory query

git config alone reads GIT_CONFIG as if it were --file, in place of the
system and global configuration, and reports it as "command"; git's
ownership check never reads it. Inherited, it could trust a store git
refuses and hide the entries git does ... (continued)

50 of 51 new or added lines in 3 files covered. (98.04%)

10080 of 10875 relevant lines covered (92.69%)

397.57 hits per line