GeezerVison is showing github.com — fix: harden config parsing boundaries by Byron · Pull Request #2211 · gitpython-developers/GitPython
Conversation
Byron
commented
Aug 10, 2026
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
Tasks
This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.
Everything below this line was generated by Codex GPT-5.
Created by Codex on behalf of Byron. Byron will review before this is ready to merge.
Summary
- Preserve parsed multiline Git config values when an unrelated write reserializes the file, keeping each value structurally intact.
- Disable include merging for
.gitmodules, so repository-controlled submodule configuration cannot cause unrelated local files to be opened.
Advisories
Both advisories remain private/under triage, so reproduction and exploit details are intentionally omitted here.
Advisory summary
- Severity: High
- Package:
GitPython (pip)
- Affected versions:
<= 3.1.58
- Patched versions: not yet assigned
- CVE: not yet assigned
- Severity: High
- Package:
GitPython (pip)
- Affected versions:
<= 3.1.58
- Patched versions: not yet assigned
- CVE: not yet assigned
Baselines
- Git
config.c at cf5497b14c5a serializes embedded LF with an escape rather than as a physical config line.
- Existing GitPython hardening in
41ecc6a4 disables include merging for another write-sensitive config parser.
Validation
- Focused regressions for both advisories
pytest -q test/test_config.py (35 passed, 2 skipped)pytest -q (passed after each commit)- Targeted Ruff lint and format checks
git diff --check
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Byron
changed the title
fix: preserve multiline config values when writing
fix: harden config parsing boundaries
Aug 10, 2026
<!-- agent -->
GitConfigParser decoded valid multiline values into embedded newlines, but
_write() serialized those newlines as indented physical lines. Rewriting an
otherwise unchanged config could therefore change its meaning to Git.
Serialize resident multiline values with Git-compatible escapes inside a
quoted continuation, preserving GitPython read compatibility while keeping
each option structurally intact. This addresses GHSA-284h-m62q-gf8w.
The regression starts with an inert multiline value, performs an unrelated
write, and verifies with both GitPython and git config that it remains one
value and does not create another option.
Git baseline: config.c parse_value() and write_pair() at cf5497b14c5a escape
embedded LF as \\n rather than emitting it as a physical config line.
Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <[email protected]>
<!-- agent -->
Submodule configuration is read from .gitmodules, whose contents may come
from an untrusted repository. Its parser inherited merge_includes=True and
could therefore open files named by include directives during ordinary
submodule enumeration.
Disable include merging at the SubmoduleConfigParser construction site. This
matches Repo.config_writer() hardening from 41ecc6a and addresses
GHSA-7833-fr7j-v32q without changing include behavior for trusted config
parsers.
The regression points .gitmodules at a non-config file and verifies the
submodule entry remains readable without opening the included path.
Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <[email protected]>
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ef7568e3b3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
Hardens Git config parsing/serialization to prevent unsafe boundary crossings when rewriting config files and when parsing repository-controlled .gitmodules, aligning GitPython behavior more closely with Git’s escaping and include-handling expectations.
Changes:
- Update
GitConfigParser writer to escape/quote values containing special characters (notably multiline values) instead of emitting physical continuation lines.
- Disable
[include] merging when parsing .gitmodules via SubmoduleConfigParser.
- Add regression tests covering multiline rewrite safety, special-character escaping, and
.gitmodules include isolation.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File |
Description |
git/config.py |
Adjusts config serialization to quote/escape special characters to preserve multiline values safely. |
git/objects/submodule/base.py |
Forces .gitmodules parsing to use merge_includes=False to avoid opening arbitrary local files. |
test/test_config.py |
Adds tests to ensure multiline rewrite doesn’t create unintended options and that special chars round-trip and match git config. |
test/test_submodule.py |
Adds a test ensuring .gitmodules does not merge includes (and thus doesn’t parse unrelated files). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Sep 18, 2026
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|