GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — prevent out-of-repo access when manipulating references. by Byron · Pull Request #2134 · gitpython-developers/GitPython

Conversation

@Byron

@Byron Byron commented Apr 28, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

This previously made it possible to create, modify and delete files outside outside of the repository, which is a problem if inputs aren't trusted.

Tasks

  • refackiew
  • pass CI
  • review

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@codex @Byron
prevent out-of-repo access when manipulating references.
25ba54d 
This previously made it possible to create, modify and delete files outside outside
of the repository, which is a problem if inputs aren't trusted.

Co-authored-by: Sebastian Thiel <[email protected]>
Copilot AI review requested due to automatic review settings April 28, 2026 01:25
Copilot started reviewing on behalf of Byron April 28, 2026 01:28
View session
Copilot AI reviewed Apr 28, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens ref/reflog filesystem path handling to prevent path traversal and other escapes that could otherwise write, rename, or delete files outside the repository’s git directories when ref inputs are untrusted.

Changes:

  • Add validated path resolution (realpath + commonpath) for ref and reflog paths to ensure they stay within the repo’s git/common dirs.
  • Use validated ref paths in SymbolicReference operations (create/set/delete/rename) and in RemoteReference.delete.
  • Add regression tests to ensure path traversal attempts are rejected.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File Description
git/refs/symbolic.py Introduces validated path helpers and applies them to ref file operations.
git/refs/remote.py Validates remote ref paths and uses validated filesystem paths when deleting ref files.
git/refs/log.py Uses validated reflog path construction.
test/test_refs.py Adds regression tests ensuring path traversal is rejected for various ref operations.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread git/refs/remote.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread test/test_refs.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Copilot AI review requested due to automatic review settings April 28, 2026 02:01
Copilot started reviewing on behalf of Byron April 28, 2026 02:04
View session
Copilot AI reviewed Apr 28, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread git/refs/symbolic.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@Byron
Byron force-pushed the validate-ref-creation branch from e90b57c to 44e8cc5 Compare April 28, 2026 02:37
Copilot AI review requested due to automatic review settings April 28, 2026 02:51
@Byron
Byron force-pushed the validate-ref-creation branch from 44e8cc5 to 38f91f0 Compare April 28, 2026 02:51
Copilot started reviewing on behalf of Byron April 28, 2026 02:52
View session
@Byron
Byron force-pushed the validate-ref-creation branch from 38f91f0 to 8c6d5ee Compare April 28, 2026 02:55
Copilot AI reviewed Apr 28, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread git/refs/symbolic.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread test/test_refs.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread git/refs/log.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@Byron
Byron force-pushed the validate-ref-creation branch from 8c6d5ee to c57e127 Compare April 28, 2026 03:12
@Byron

Byron commented Apr 28, 2026

Copy link
Copy Markdown
Member Author

On Byron's behalf: Review pass on the latest Copilot comments:

  • I addressed the RefLog.path() docstring comment in c57e127b by documenting the new ValueError case.
  • I am intentionally not taking the two symlink-hardening suggestions in this review commit. They reintroduce explicit segment walking/path manipulation that this simplification was meant to avoid, and they broaden the patch from validating attacker-controlled ref names to defending against pre-existing attacker-controlled symlinks under .git/refs. The current patch keeps the implementation to ref-name validation plus realpath/commonpath, with symlink coverage only where realpath provides that signal.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@codex @Byron
address review feedback and CI failures
4af8463 
Consolidate follow-up fixes from review and CI:

- fix lint and mypy issues in reference log path handling
- validate remote reference paths before invoking git branch deletion
- add symlink escape coverage where realpath resolves symlinks
- ensure temporary test repositories release git resources during cleanup

Co-authored-by: Sebastian Thiel <[email protected]>
@Byron
Byron force-pushed the validate-ref-creation branch from c57e127 to 4af8463 Compare April 28, 2026 05:13
@Byron
Byron merged commit dbfa264 into main Apr 28, 2026
59 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@Byron
Byron deleted the validate-ref-creation branch October 5, 2026 03:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@Byron @codex
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.