Skip to content

fix: harden Git inspection against executable configuration - #81

Open
phibkro wants to merge 1 commit into
tobi:mainfrom
phibkro:fix/git-inspection-safety
Open

phibkro wants to merge 1 commit into
tobi:mainfrom
phibkro:fix/git-inspection-safety

Conversation

@phibkro

@phibkro phibkro commented Oct 11, 2026

Copy link
Copy Markdown

Reproduction

Throwaway fixtures against origin/main's shared Git command wrapper (not included here) ran a configured external diff program and a configured textconv program and created marker files. Those diff forms occur in tests today, not in production status inspection. A further regression runs in a child environment with GIT_CONFIG_COUNT=1, KEY_0=core.fsmonitor and VALUE_0 set to a quoted marker script; it asserts the variables are removed and no marker appears.

Fix

Pin safe inspection configuration, ignore global and system configuration, and disable optional locking and lazy fetch. Remove inherited command-scope configuration and the indexed KEY/VALUE entries. Diff invocations use --no-ext-diff --no-textconv. Fixture setup ignores ambient configuration, quotes paths containing spaces or apostrophes, and checks real Git availability without triggering macOS install prompts. Corrects a stale comment about global filters. No new dependencies.

Checks run

cargo xtask lint passed. cargo xtask test passed: 75 app, 140 core (2 ignored), 3 xtask. The inherited-config, external-diff and textconv regressions each passed (1 passed).

Conflict with #59

Based on origin/main 6c8d4ce. #59 moves crates/disktree-app/src/git.rs into disktree-core, so this will conflict. If #59 lands first, port the shared hardened builder and its fixtures to the moved module; I'm happy to do that.

Limitations

The adversarial fixtures ran on Linux only; Windows was not verified. The separate filter-preflight and status subprocesses keep a window for concurrent repository configuration changes, so this is not complete hostile-repository isolation.


Developed with AI assistance (OMP agents). I reviewed the diffs; every check listed was run on the final branch.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant