fix(index): let git check the repository before running a commit hook

`run_commit_hook` finds a hook in `.git/hooks` or `core.hooksPath`, read
through GitPython's own config parser, and executes it directly. No git
command runs before that, so git's check that the repository is safe to
use (the ownership and `safe.directory` check added for CVE-2022-24765)
has not happened when code from the repository is executed.

`IndexFile.commit` runs the `pre-commit` and `commit-msg` hooks before
it calls git at all. In a repository owned by another user, where
`git commit` stops with "detected dubious ownership" without running any
hook, `repo.index.commit()` ran the repository's `pre-commit` hook and
only then failed in `git hash-object`. That is the situation git's check
exists for: a `.git` directory planted by another user in a shared or
parent directory (`Repo(path, search_parent_directories=True)` finds it
the same way git would).

Before executing a hook that exists, `run_commit_hook` now runs
`git rev-parse --git-dir` in the repository, so git applies its own
policy, including `safe.directory` and the exemptions git makes. When
git refuses, the `GitCommandError` it raises is the one the commit
already ended with, only now before the hook runs. When git accepts the
repository, hooks run as before, and nothing changes when there is no
hook. Asking git, rather than reimplementing the ownership rules, keeps
the result identical to `git commit` for every git version, including
versions older than 2.35.2 that make no check.

Adds `test_pre_commit_hook_not_run_in_repository_git_refuses` to
`test/test_index.py`, which uses git's `GIT_TEST_ASSUME_DIFFERENT_OWNER`
to simulate another owner; it fails before this change and passes
after. `test_run_commit_hook` and
`test_run_commit_hook_outside_worktree_on_windows` mock `Git.execute`
(the latter because it fakes the Windows `PATH`), so they now allow this
one call while still rejecting any git command during hook lookup.

`ruff check`, `ruff format --check` and `mypy` pass. In a full clone
prepared with `init-tests-after-clone.sh`, the pytest suite passes
except `test_diff_with_staged_file`, `test_index_mutation`,
`test_blame_content_with_carriage_returns`, `test_empty_repo`,
`test_rebasing` and the two `test_actor_get_uid_laziness_*` tests,
which fail the same way without this change on this machine.

Author: Keerthana-64

git/index/fun.py

@@ -185,11 +185,20 @@ def run_commit_hook(name: str, index: "IndexFile", *args: str) -> None:
         Arguments passed to hook file.
 
     :raise git.exc.HookExecutionError:
+
+    :raise git.exc.GitCommandError:
+        If Git refuses to work in the repository, for instance because it is owned by
+        another user and not listed in ``safe.directory``. The hook is not run then.
     """
     hp = _commit_hook_path(name, index)
     if not os.access(hp, os.X_OK):
         return
 
+    # Hooks are found and run without invoking Git, so Git's check of whether the
+    # repository is safe to use has not happened yet. Let Git apply it before
+    # executing code taken from the repository.
+    index.repo.git.rev_parse("--git-dir")
+
     env = os.environ.copy()
     env["GIT_INDEX_FILE"] = safe_decode(os.fspath(index.path))
     env["GIT_EDITOR"] = ":"

test/test_index.py

@@ -189,6 +189,12 @@ def _make_hook(git_dir, name, content, make_exec=True):
     return hp
 
 
+def _only_ownership_check(command, *args, **kwargs):
+    """Stand in for :meth:`Git.execute`, allowing only the check before running a hook."""
+    if command[1:] != ["rev-parse", "--git-dir"]:
+        raise AssertionError("hook lookup must not run git: %r" % (command,))
+
+
 def _raw_index(path, mode=0o100644):
     """Build an index without using the writer under test."""
     name = path.encode("utf-8")
@@ -1496,7 +1502,7 @@ def test_run_commit_hook(self, rw_repo):
         _make_hook(index.repo.git_dir, "fake-hook", "echo 'ran fake hook' >output.txt")
         output = Path(rw_repo.git_dir, "output.txt")
         with mock.patch.object(Repo, "config_level", ("repository",)):
-            with mock.patch.object(Git, "execute", side_effect=AssertionError("hook lookup must not run git")):
+            with mock.patch.object(Git, "execute", side_effect=_only_ownership_check):
                 run_commit_hook("fake-hook", index)
                 self.assertEqual(output.read_text(encoding="utf-8"), "ran fake hook\n")
 
@@ -1533,7 +1539,7 @@ def command(hooks_path, exec_path):
             ):
                 with mock.patch("git.index.fun.safer_popen") as popen, mock.patch(
                     "git.index.fun.handle_process_output"
-                ):
+                ), mock.patch.object(Git, "execute", side_effect=_only_ownership_check):
                     popen.return_value.returncode = 0
                     run_commit_hook("fake-hook", repo.index)
             return popen.call_args[0][0]
@@ -1707,6 +1713,20 @@ def test_pre_commit_hook_outside_worktree(self, rw_dir):
         output = Path(repo.working_dir, "outside-hook-output.txt").read_text(encoding="utf-8")
         self.assertEqual(output, "ran outside hook\n")
 
+    @with_rw_directory
+    def test_pre_commit_hook_not_run_in_repository_git_refuses(self, rw_dir):
+        repo = Repo.init(osp.join(rw_dir, "repo"))
+        if repo.git.version_info < (2, 35, 2):
+            self.skipTest("Git checks repository ownership since 2.35.2")
+        _make_hook(repo.git_dir, "pre-commit", "echo 'ran hook' >hook-output.txt")
+
+        # Git's test hook makes it treat the repository as owned by another user.
+        with mock.patch.dict(os.environ, {"GIT_TEST_ASSUME_DIFFERENT_OWNER": "1"}):
+            with self.assertRaisesRegex(GitCommandError, "dubious ownership"):
+                repo.index.commit("Git refuses this repository")
+
+        self.assertFalse(osp.exists(osp.join(repo.working_dir, "hook-output.txt")))
+
     @pytest.mark.xfail(
         type(_win_bash_status) is WinBashStatus.WslNoDistro,
         reason="Currently uses the bash.exe of WSL, even with no WSL distro installed",