golangci-lint (gosec G703) flags the worktree and commondir path reads as
path traversal because it cannot see across the validation functions. Each
resolved path is constrained before use: it must point into an existing
directory that is not the repository's GIT_DIR, and for linked worktrees
the .git entry must in turn reference this repository. Annotate the read
sites to reflect that these are trusted repository-local paths.
Also fix test-only lints from the CI gate: use 0600 file permissions for
temporary files and mark TestGetWorktree parallel at the top level.
Signed-off-by: lakshit verma <vermalucky2004@gmail.com>
Review feedback flagged that the resolved worktree path was trusted
without verifying it actually belongs to the repository. A stale
$GIT_DIR/gitdir pointer, or one pointing at a different repository,
could silently redirect status and restore into wrong directories.
core.worktree was also read from every config scope, so a global or
system setting would override discovery for every repository.
- verify the gitdir link in both directions: the .git entry the pointer
names must in turn reference this GIT_DIR
- prefer the worktree discovered at load time over core.worktree, and
read core.worktree from repository-local config only
- fall back to looking for bare sentinel files instead of the GIT_DIR
name, which inverted for bare repos named repo.git and linked worktrees
- compare worktree and GIT_DIR paths after resolving symlinks
- require the common-dir config to be a regular file before reading it
- separate restore pathspecs from options with "--"
- case-fold repository environment variable keys in the test helper for
Windows, and parallelize the new worktree tests
Signed-off-by: lakshit verma <vermalucky2004@gmail.com>
Worktree resolution chopped ".git" off the resolved GIT_DIR path, which
only works for the standard <repo>/.git layout. This breaks repositories
created with --separate-git-dir, misclassifies linked worktrees as bare
(so file restoration was silently skipped), and misclassifies bare
repositories named foo.git as non-bare. Linked worktrees could not even
be loaded because ensureNoCompatObjectFormat expects a config file that
only exists in the repository's common Git directory.
- add Repository.GetWorktree() resolving via $GIT_DIR/gitdir,
core.worktree, load-time discovery, then the standard layout;
validated so stale or malformed records fall through cleanly
- determine bareness via rev-parse --is-bare-repository instead of the
GIT_DIR name, exposed through the ErrNoWorktree sentinel
- read configuration from the common directory via $GIT_DIR/commondir
- route Status(), RestoreWorktree(), and post-propagation restore
through GetWorktree()
Fixes#1006
Signed-off-by: lakshit verma <vermalucky2004@gmail.com>
