A folder's own configuration names no proxy for the fetch, and git's own folder name is not a repository name #184

New Issue

2026-11-11T05:55:46Z

james.maes commented

2026-11-11 05:55:46 +00:00

Two small hardening items from the security review of the 1.1.1 release candidate. Neither exposes a token; both make a stated rule hold everywhere.

A folder's own git configuration does not decide where a sync's fetch goes (#139). That is enforced for URL rewrites and for the SSH program. A proxy named in the folder's own configuration is still honored. It should be refused in the same way, with a message that names the setting; a proxy in the user's global configuration stays theirs.
A repository name is one safe folder name. Tree paths may not contain git's own folder name in any spelling Windows opens as that folder; a repository name is checked for that only on the Windows sync path. RepositoryPathResolver.TryValidateName should refuse it on every platform, so every caller (the WSL clone, the library on other platforms) gets the same answer.

Each with a regression test, and the threat model's T3 and T4 rows updated.

Two small hardening items from the security review of the 1.1.1 release candidate. Neither exposes a token; both make a stated rule hold everywhere. 1. **A folder's own git configuration does not decide where a sync's fetch goes** (#139). That is enforced for URL rewrites and for the SSH program. A proxy named in the folder's own configuration is still honored. It should be refused in the same way, with a message that names the setting; a proxy in the user's global configuration stays theirs. 2. **A repository name is one safe folder name.** Tree paths may not contain git's own folder name in any spelling Windows opens as that folder; a repository name is checked for that only on the Windows sync path. `RepositoryPathResolver.TryValidateName` should refuse it on every platform, so every caller (the WSL clone, the library on other platforms) gets the same answer. Each with a regression test, and the threat model's T3 and T4 rows updated.

james.maes added the bug label 2026-11-11 05:55:46 +00:00

james.maes referenced this issue from a commit

2026-11-11 06:01:37 +00:00

fix(engine): a folder's own configuration names no proxy for the fetch, and git's own folder name is not a repository name

james.maes referenced a pull request that will close this issue

2026-11-11 06:01:37 +00:00

fix(engine): a folder's own configuration names no proxy for the fetch, and git's own folder name is not a repository name #198

james.maes referenced this issue

2026-11-11 06:14:57 +00:00

The updater checks something the release server cannot change #189

james.maes referenced this issue from a commit

2026-11-11 06:19:55 +00:00