From 073ec2f140d233221df2103b93ca1398462fb05c Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Tue, 23 Jun 2026 16:59:47 +0000 Subject: [PATCH 1/2] Fix git core.fsmonitor local execution vulnerabilities Passed `_SAFE_GIT_CONFIG = ("-c", "core.fsmonitor=false")` to all untrusted Git subprocess executions in delta and legis. Co-authored-by: tachyon-beep <544926+tachyon-beep@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ src/wardline/core/delta.py | 9 +++++---- src/wardline/core/legis.py | 6 ++++-- tests/unit/core/test_delta.py | 4 ++-- 4 files changed, 15 insertions(+), 8 deletions(-) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 00000000..9d30b71f --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2025-02-14 - Prevent Git Config Code Execution +**Vulnerability:** Invoking `git` via `subprocess` against untrusted directories without overriding config can allow malicious repositories to execute code via `.git/config` hooks like `core.fsmonitor`. +**Learning:** `git` uses configurations from the `.git/config` file in the current working directory or `cwd` argument, which could be controlled by an attacker when analyzing untrusted codebases. +**Prevention:** Explicitly pass `("-c", "core.fsmonitor=false")` as `_SAFE_GIT_CONFIG` to all `git` subprocess commands in the codebase. diff --git a/src/wardline/core/delta.py b/src/wardline/core/delta.py index c4d63f0e..99f7eb59 100644 --- a/src/wardline/core/delta.py +++ b/src/wardline/core/delta.py @@ -11,6 +11,7 @@ if TYPE_CHECKING: from wardline.scanner.index import Entity +_SAFE_GIT_CONFIG = ("-c", "core.fsmonitor=false") def get_changed_files_since(ref: str, root: Path) -> set[str]: """Get the set of file paths (repo-relative, POSIX-style matching Location.path) @@ -22,7 +23,7 @@ def get_changed_files_since(ref: str, root: Path) -> set[str]: # 1. Get the git toplevel directory. try: res = subprocess.run( - ["git", "rev-parse", "--show-toplevel"], + ["git", *_SAFE_GIT_CONFIG, "rev-parse", "--show-toplevel"], cwd=root, capture_output=True, text=True, @@ -38,7 +39,7 @@ def get_changed_files_since(ref: str, root: Path) -> set[str]: # 2. Resolve ref to a verified object id before passing it to git diff. try: res = subprocess.run( - ["git", "rev-parse", "--verify", "--end-of-options", ref], + ["git", *_SAFE_GIT_CONFIG, "rev-parse", "--verify", "--end-of-options", ref], cwd=git_toplevel, capture_output=True, text=True, @@ -54,7 +55,7 @@ def get_changed_files_since(ref: str, root: Path) -> set[str]: # 3. Get changed files since ref (committed since ref, staged, unstaged). try: res = subprocess.run( - ["git", "diff", "--name-only", verified_ref, "--"], + ["git", *_SAFE_GIT_CONFIG, "diff", "--name-only", verified_ref, "--"], cwd=git_toplevel, capture_output=True, text=True, @@ -68,7 +69,7 @@ def get_changed_files_since(ref: str, root: Path) -> set[str]: # 4. Get untracked files. try: res = subprocess.run( - ["git", "ls-files", "--others", "--exclude-standard"], + ["git", *_SAFE_GIT_CONFIG, "ls-files", "--others", "--exclude-standard"], cwd=git_toplevel, capture_output=True, text=True, diff --git a/src/wardline/core/legis.py b/src/wardline/core/legis.py index 87144974..08bbc6e7 100644 --- a/src/wardline/core/legis.py +++ b/src/wardline/core/legis.py @@ -190,6 +190,8 @@ def project_finding(finding: Finding) -> dict[str, Any]: } +_SAFE_GIT_CONFIG = ("-c", "core.fsmonitor=false") + def _git_tree_sha(root: Path) -> str | None: """The committed tree object SHA (``git rev-parse HEAD^{tree}``), or None. @@ -199,7 +201,7 @@ def _git_tree_sha(root: Path) -> str | None: """ try: rev = subprocess.run( - ["git", "rev-parse", "HEAD^{tree}"], + ["git", *_SAFE_GIT_CONFIG, "rev-parse", "HEAD^{tree}"], cwd=root, capture_output=True, text=True, @@ -215,7 +217,7 @@ def _git_repo_root(root: Path) -> Path | None: """The containing git repository root, or None when unavailable.""" try: rev = subprocess.run( - ["git", "rev-parse", "--show-toplevel"], + ["git", *_SAFE_GIT_CONFIG, "rev-parse", "--show-toplevel"], cwd=root, capture_output=True, text=True, diff --git a/tests/unit/core/test_delta.py b/tests/unit/core/test_delta.py index 5b16c7af..b338f453 100644 --- a/tests/unit/core/test_delta.py +++ b/tests/unit/core/test_delta.py @@ -43,8 +43,8 @@ def run_dispatch(args, **kwargs): res = get_changed_files_since("HEAD~1", root) assert res == {"foo.py", "bar.py", "baz.py"} - assert mock_run.call_args_list[1].args[0] == ["git", "rev-parse", "--verify", "--end-of-options", "HEAD~1"] - assert mock_run.call_args_list[2].args[0] == ["git", "diff", "--name-only", "abc123", "--"] + assert mock_run.call_args_list[1].args[0] == ["git", "-c", "core.fsmonitor=false", "rev-parse", "--verify", "--end-of-options", "HEAD~1"] + assert mock_run.call_args_list[2].args[0] == ["git", "-c", "core.fsmonitor=false", "diff", "--name-only", "abc123", "--"] @patch("subprocess.run") From 8418c776424f16aff5a24544f04b2044e7c35153 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Tue, 23 Jun 2026 17:04:53 +0000 Subject: [PATCH 2/2] Fix git core.fsmonitor local execution vulnerabilities Passed `_SAFE_GIT_CONFIG = ("-c", "core.fsmonitor=false")` to all untrusted Git subprocess executions in delta and legis. Co-authored-by: tachyon-beep <544926+tachyon-beep@users.noreply.github.com> --- src/wardline/core/delta.py | 1 + src/wardline/core/legis.py | 1 + tests/unit/core/test_delta.py | 20 ++++++++++++++++++-- 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/src/wardline/core/delta.py b/src/wardline/core/delta.py index 99f7eb59..764c3c47 100644 --- a/src/wardline/core/delta.py +++ b/src/wardline/core/delta.py @@ -13,6 +13,7 @@ _SAFE_GIT_CONFIG = ("-c", "core.fsmonitor=false") + def get_changed_files_since(ref: str, root: Path) -> set[str]: """Get the set of file paths (repo-relative, POSIX-style matching Location.path) that have changed since `ref`, including staged, unstaged, and untracked changes. diff --git a/src/wardline/core/legis.py b/src/wardline/core/legis.py index 08bbc6e7..fe23fcb9 100644 --- a/src/wardline/core/legis.py +++ b/src/wardline/core/legis.py @@ -192,6 +192,7 @@ def project_finding(finding: Finding) -> dict[str, Any]: _SAFE_GIT_CONFIG = ("-c", "core.fsmonitor=false") + def _git_tree_sha(root: Path) -> str | None: """The committed tree object SHA (``git rev-parse HEAD^{tree}``), or None. diff --git a/tests/unit/core/test_delta.py b/tests/unit/core/test_delta.py index b338f453..9d0ca7ba 100644 --- a/tests/unit/core/test_delta.py +++ b/tests/unit/core/test_delta.py @@ -43,8 +43,24 @@ def run_dispatch(args, **kwargs): res = get_changed_files_since("HEAD~1", root) assert res == {"foo.py", "bar.py", "baz.py"} - assert mock_run.call_args_list[1].args[0] == ["git", "-c", "core.fsmonitor=false", "rev-parse", "--verify", "--end-of-options", "HEAD~1"] - assert mock_run.call_args_list[2].args[0] == ["git", "-c", "core.fsmonitor=false", "diff", "--name-only", "abc123", "--"] + assert mock_run.call_args_list[1].args[0] == [ + "git", + "-c", + "core.fsmonitor=false", + "rev-parse", + "--verify", + "--end-of-options", + "HEAD~1", + ] + assert mock_run.call_args_list[2].args[0] == [ + "git", + "-c", + "core.fsmonitor=false", + "diff", + "--name-only", + "abc123", + "--", + ] @patch("subprocess.run")