mirror of
https://github.com/openai/codex.git
synced 2026-09-06 15:29:32 +00:00
bc3545b805
## Why A checkout could point its `.git` file at a trusted repository's worktree directory without proving that the repository had registered that checkout. This could cause project configuration from an unrelated checkout to be treated as trusted. ## What changed - Verify the linked worktree's `gitdir` backlink, `commondir`, registered checkout, and main checkout ownership before resolving the main repository's trust key. - Reject missing, oversized, symlinked, mismatched, or swapped Git metadata. - Preserve valid linked worktrees that use path aliases, separate Git directories, or non-UTF-8 POSIX paths. ## Testing Add resolver and config-loading coverage for forged worktrees, metadata races, case-sensitive paths, moved worktrees, and host MCP startup from project config. GitOrigin-RevId: 6052a7d10ad2d613436f20175c356abdef8c758e
52 lines
1.8 KiB
Rust
52 lines
1.8 KiB
Rust
use crate::PathConvention;
|
|
use crate::PathUri;
|
|
use crate::PathUriParseError;
|
|
|
|
impl PathUri {
|
|
/// Resolves a native path stored as bytes, using this URI's path convention.
|
|
///
|
|
/// UTF-8 paths follow [`Self::join`]. Non-UTF-8 POSIX names are preserved
|
|
/// losslessly, including when the filesystem is on another host. Invalid
|
|
/// UTF-8 Windows paths, null bytes, and opaque base URIs are rejected.
|
|
pub fn join_native_bytes(&self, path: &[u8]) -> Result<Self, PathUriParseError> {
|
|
if let Ok(path) = std::str::from_utf8(path) {
|
|
return self.join(path);
|
|
}
|
|
if self.infer_path_convention() != Some(PathConvention::Posix)
|
|
|| self.opaque_fallback_bytes().is_some()
|
|
|| path.contains(&0)
|
|
{
|
|
return Err(PathUriParseError::InvalidFileUriPath {
|
|
path: self.to_string(),
|
|
});
|
|
}
|
|
let mut segments = if path.starts_with(b"/") {
|
|
Vec::new()
|
|
} else {
|
|
self.encoded_path()
|
|
.split('/')
|
|
.filter(|segment| !segment.is_empty())
|
|
.map(str::to_owned)
|
|
.collect::<Vec<_>>()
|
|
};
|
|
for component in path.split(|byte| *byte == b'/') {
|
|
match component {
|
|
b"" | b"." => {}
|
|
b".." => {
|
|
segments.pop();
|
|
}
|
|
component => segments.push(urlencoding::encode_binary(component).into_owned()),
|
|
}
|
|
}
|
|
let mut url = self.to_url();
|
|
url.set_path(&format!("/{}", segments.join("/")));
|
|
let uri = Self::try_from(url)?;
|
|
if uri.infer_path_convention() != Some(PathConvention::Posix) {
|
|
return Err(PathUriParseError::InvalidFileUriPath {
|
|
path: uri.to_string(),
|
|
});
|
|
}
|
|
Ok(uri)
|
|
}
|
|
}
|