Skip to content

Harden Git provenance capture against repository config execution - #83

Open
tachyon-beep wants to merge 1 commit into
mainfrom
codex/fix-git-provenance-capture-vulnerability
Open

Harden Git provenance capture against repository config execution#83
tachyon-beep wants to merge 1 commit into
mainfrom
codex/fix-git-provenance-capture-vulnerability

Conversation

@tachyon-beep

Copy link
Copy Markdown
Collaborator

Motivation

  • Prevent untrusted repository-local Git configuration (for example core.fsmonitor or diff.external) from executing arbitrary commands during annotation provenance capture.

Description

  • Disable repository-controlled helpers and hooks when invoking Git for provenance by running Git with --no-optional-locks and per-invocation -c options including core.fsmonitor=false, core.hooksPath=/dev/null, and diff.external= in _run_git.
  • Suppress external diff drivers and textconv for on-disk diffs by injecting --no-ext-diff and --no-textconv for diff invocations while preserving built-in Git diff output.
  • Add a regression test test_provenance_does_not_execute_repository_git_config that configures hostile core.fsmonitor and diff.external helpers and asserts that annotation provenance is captured without executing the repository helper.
  • Commit recorded as fix: harden annotation git provenance capture to harden annotation-related code paths used by the CLI and MCP tools.

Testing

  • git diff --check succeeded locally on the working tree.
  • ruff check src/filigree/db_annotations.py tests/core/test_annotations.py passed in the environment where checks were run.
  • A direct Git invocation reproducing the hardened flags (git --no-optional-locks -c core.fsmonitor=false -c core.hooksPath=/dev/null -c diff.external= -C . diff --no-ext-diff --no-textconv -- <path>) produced the expected diff output without invoking repo-local helpers.
  • pytest and mypy runs could not be completed in the execution environment due to unavailable project dependencies and blocked PyPI access, so automated test execution of the new regression test was not fully verifiable in this environment.

Codex Task

Copilot AI lite review requested due to automatic review settings September 1, 2026 18:59
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens annotation provenance capture by preventing repository-local Git configuration from triggering command execution during read-only Git invocations used by annotate_file.

Changes:

  • Harden _run_git by passing per-invocation git flags/config to disable repository-controlled helpers (e.g., core.fsmonitor, diff.external).
  • Further harden git diff calls by adding --no-ext-diff and --no-textconv.
  • Add a regression test that configures hostile repo-local Git settings and asserts provenance capture completes without executing the helper.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
src/filigree/db_annotations.py Adds hardened git invocation flags and disables ext-diff/textconv for diff provenance.
tests/core/test_annotations.py Adds a regression test to ensure repository-configured Git helpers are not executed during provenance capture.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines +199 to +207
"git",
"--no-optional-locks",
"-c",
"core.fsmonitor=false",
"-c",
"core.hooksPath=/dev/null",
"-c",
"diff.external=",
"-C",
Comment on lines +71 to +79
def test_provenance_does_not_execute_repository_git_config(self, tmp_path: Path) -> None:
db = _project_db(tmp_path)
try:
source = tmp_path / "tracked.py"
marker = tmp_path / "git-config-executed"
helper = tmp_path / "malicious-helper.sh"
helper.write_text(f"#!/bin/sh\ntouch '{marker}'\n")
helper.chmod(0o755)
source.write_text("original\n")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants