bug: git submodule add in of nested submodule handles relative path wrong

joey@darkstar:/tmp/empty>git init sub1 Initialized empty Git repository in /tmp/empty/sub1/.git/ joey@darkstar:/tmp/empty>git init sub2 Initialized empty Git repository in /tmp/empty/sub2/.git/ joey@darkstar:/tmp/empty>cd sub1 joey@darkstar:/tmp/empty/sub1>date > f1 ; git add f1; git commit -m add -q joey@darkstar:/tmp/empty/sub1>cd .. joey@darkstar:/tmp/empty>cd sub2 joey@darkstar:/tmp/empty/sub2>date > f2 ; git add f2; git commit -m add -q joey@darkstar:/tmp/empty/sub2>cd .. joey@darkstar:/tmp/empty>git init repo Initialized empty Git repository in /tmp/empty/repo/.git/ joey@darkstar:/tmp/empty>cd repo joey@darkstar:/tmp/empty/repo>git submodule add ../sub1 1 Cloning into '1'... done. joey@darkstar:/tmp/empty/repo>cd 1 joey@darkstar:/tmp/empty/repo/1>ls f1 joey@darkstar:/tmp/empty/repo/1>git submodule add ../../sub2 2 fatal: repository '/tmp/sub2' does not exist fatal: clone of '/tmp/sub2' into submodule path '2' failed

Like the bug I filed yesterday, this is caused by git submodule add's chdir into .git/modules.

Workaround is to pass absolute paths to git submodule add.

Note that this could be an exploitable security hole under some unusual circumstances. In the example above, any other local user could create a /tmp/sub2 containing something nasty, and git would check it out accidentially.

git version 2.7.0