GeezerVison

Problem

A batch container can create a .git/commondir file that points Git to an attacker-controlled directory. The existing metadata restoration only restores .git/config and .git/config.worktree, so host-side Git commands can still read malicious configuration from the redirected directory. A malicious clean filter can then run code on the host outside the container.

This fixes VULN-153.

Solution

Snapshot .git/commondir with the other trusted Git control files and restore it before every host-side Git command. If the original repository did not have a commondir file, an injected file is removed before Git runs.

The regression test creates an attacker-controlled common directory with a malicious clean filter and verifies that diff generation uses the trusted Git configuration instead.

Verification Evidence

• go test ./internal/batches/workspace -count=1
• go test ./internal/batches/...
• git diff --check