From: brian m. carlson <sandals@crustytoothpaste.net>
Date: Thu, 12 Feb 2026 22:39:05 GMT
Subject: Re: [RFC] setup: fail if .git is not a file or directory
Message-ID: <aY5Wid6eg1-LwZm8@fruit.crustytoothpaste.net>
In-Reply-To: <20260211182122.35352-1-a3205153416@gmail.com>

On 2026-02-11 at 18:21:22, Tian Yuchen wrote:
> Currently, `setup_git_directory_gently_1()` checks if `.git` is a
> regular file (handling submodules/worktrees) or a directory. If it is
> neither (e.g., a FIFO), the code hits a NEEDSWORK comment and simply
> ignores the entity, continuing the discovery process in the parent
> directory.
> 
> This behavior can be very dangerous. If a user is inside a subdirectory
> containing a melformed/broken `.git` entity, the Git will traverse up,
> attach to a parent repository and might execute destructive commands.
> 
> I tried to resolve the NEEDSWORK by using `lstat()` to explicitly check
> the entity's mode. If it is neither a regular file nor a directory, we
> kill the discovery process.

We used to allow symlinks as well.  That was used instead of gitfiles
for submodules at one point, I believe, and there may still be some
people using that.  A brief test indicates that that functionality still
works, so if we make a change here, we should be sure to accept symlinks
as well.

In general, we should allow people to use symlinks wherever they can use
a file or directory unless we can definitively prove that there's a
clear security or functionality problem that cannot be avoided.  Git was
originally written for Unix, after all.
-- 
brian m. carlson (they/them)
Toronto, Ontario, CA