Method TestSubmoduleRepositoryRejectsEscapingName

submodule_test.go:588–624

TestSubmoduleRepositoryRejectsEscapingName covers the storage-layer defence against submodule name path traversal. Constructing a Submodule with `Name = ".."` programmatically (bypassing the .gitmodules parser) must not result in `Repository()` opening a storer rooted in the parent's `.git/` directo

(c *C)

// storer rooted in the parent's `.git/` directory, and must leave the
// parent's HEAD reference untouched.
func (s *SubmoduleSuite) TestSubmoduleRepositoryRejectsEscapingName(c *C) {
	dotfs := memfs.New()
	wtfs := memfs.New()
	// Use filesystem.NewStorage rather than memory.NewStorage for the
	// parent because only the filesystem-backed ModuleStorer exercises
	// the dotgit defence; the in-memory implementation maps names to
	// storage units directly without traversing a path.
	storer := filesystem.NewStorage(dotfs, cache.NewObjectLRUDefault())
	r, err := Init(storer, wtfs)
	c.Assert(err, IsNil)

	wt, err := r.Worktree()
	c.Assert(err, IsNil)

	headBefore, err := storer.Reference(plumbing.HEAD)
	c.Assert(err, IsNil)

	sm := &Submodule{
		initialized: true,
		c: &config.Submodule{
			Name: "..",
			Path: "deps/x",
			URL:  "https://example.com/",
		},
		w: wt,
	}

	repo, err := sm.Repository()
	c.Assert(err, NotNil)
	c.Assert(errors.Is(err, dotgit.ErrModuleNameEscape), Equals, true)
	c.Assert(repo, IsNil)

	headAfter, err := storer.Reference(plumbing.HEAD)
	c.Assert(err, IsNil)
	c.Assert(headBefore.Target(), Equals, headAfter.Target(),
		Commentf("parent HEAD must not be overwritten"))
}