GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix/batches: prevent repository archives from enabling Git hooks by cbrnrd · Pull Request #1367 · sourcegraph/src-cli

Conversation

@cbrnrd

@cbrnrd cbrnrd commented Sep 3, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Problem

This issue was brought to our attention via HackerOne.

On Windows, Git repository archive names can contain backslashes that are treated as directory separators during extraction. This can place repository files in Git metadata paths and allow a host-side Git hook to run before the batch step starts.

Solution

Reject archive names that contain backslashes before extracting any files. Also disable hooks for every host-side Git command as a second layer of protection.

This change is intended to merge after #1366, which rejects archive entries that resolve to .git paths.

Verification Evidence

  • go test ./internal/batches/...
  • Windows test binary cross-compiled with GOOS=windows GOARCH=amd64 go test -c ./internal/batches/workspace

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@cbrnrd
cbrnrd marked this pull request as ready for review September 3, 2026 17:47
@cbrnrd
cbrnrd requested a review from a team September 3, 2026 17:47
BolajiOlajide
BolajiOlajide approved these changes Sep 3, 2026
View reviewed changes
@cbrnrd
fix/batches: prevent repository archives from enabling Git hooks
d228bd5
@cbrnrd
cbrnrd force-pushed the carterbrainerd-vuln-146-i-can-turn-committed-backslash-filenames-into-host-git-hooks branch from 38256df to d228bd5 Compare September 3, 2026 17:57
@cbrnrd
cbrnrd enabled auto-merge (squash) September 3, 2026 18:00
@cbrnrd
cbrnrd merged commit 3812c34 into main Sep 3, 2026
7 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@cbrnrd
cbrnrd deleted the carterbrainerd-vuln-146-i-can-turn-committed-backslash-filenames-into-host-git-hooks branch September 3, 2026 18:03
@cbrnrd cbrnrd mentioned this pull request Sep 4, 2026
fix/batches: discard extracted Git metadata before Git initialization #1370
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BolajiOlajide BolajiOlajide BolajiOlajide approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@cbrnrd @BolajiOlajide
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.