AI-written code blocked unsafe path strings but ignored existing symlinks, letting worktree writes escape and modify files outside the repository.

+	"os"+	"path/filepath"+	"runtime"+	"slices"+	"strings"++	"github.com/go-git/go-billy/v5"+)++// worktreeFilesystem wraps a billy.Filesystem and validates every path passed+// to a mutating operation. This prevents writing to, or deleting from,+// dangerous locations (e.g. .git/*, ../) regardless of which worktree+// code path triggers the operation.+type worktreeFilesystem struct {+	billy.Filesystem+}++func newWorktreeFilesystem(fs billy.Filesystem) *worktreeFilesystem {+	return &worktreeFilesystem{Filesystem: fs}+}++func (sfs *worktreeFilesystem) Create(filename string) (billy.File, error) {+	if err := validPath(filename); err != nil {+		return nil, err+	}+	return sfs.Filesystem.Create(filename)+}++func (sfs *worktreeFilesystem) OpenFile(filename string, flag int, perm os.FileMode) (billy.File, error) {+	if err := validPath(filename); err != nil {+		return nil, err+	}+	return sfs.Filesystem.OpenFile(filename, flag, perm)+}++func (sfs *worktreeFilesystem) Remove(filename string) error {+	if err := validPath(filename); err != nil {+		return err+	}+	return sfs.Filesystem.Remove(filename)+}++func (sfs *worktreeFilesystem) Rename(from, to string) error {+	if err := validPath(from, to); err != nil {+		return err+	}+	return sfs.Filesystem.Rename(from, to)+}++func (sfs *worktreeFilesystem) Symlink(target, link string) error {+	if err := validPath(link); err != nil {+		return err+	}+	return sfs.Filesystem.Symlink(target, link)+}++func (sfs *worktreeFilesystem) MkdirAll(path string, perm os.FileMode) error {+	if err := validPath(path); err != nil {+		return err+	}+	return sfs.Filesystem.MkdirAll(path, perm)+}++// worktreeDeny is a list of paths that are not allowed+// to be used when resetting the worktree.+var worktreeDeny = map[string]struct{}{+	// .git+	GitDirName: {},++	// For other historical reasons, file names that do not conform to the 8.3+	// format (up to eight characters for the basename, three for the file+	// extension, certain characters not allowed such as `+`, etc) are associated+	// with a so-called "short name", at least on the `C:` drive by default.+	// Which means that `git~1/` is a valid way to refer to `.git/`.+	"git~1": {},+}++// validPath checks whether paths are valid.+// The rules around invalid paths could differ from upstream based on how+// filesystems are managed within go-git, but they are largely the same.+//+// For upstream rules:+// https://github.com/git/git/blob/564d0252ca632e0264ed670534a51d18a689ef5d/read-cache.c#L946+// https://github.com/git/git/blob/564d0252ca632e0264ed670534a51d18a689ef5d/path.c#L1383+func validPath(paths ...string) error {

@@ -489,90 +488,6 @@ func (w *Worktree) resetWorktree(t *object.Tree, files []string) error { 	return w.r.Storer.SetIndex(idx) } -// worktreeDeny is a list of paths that are not allowed-// to be used when resetting the worktree.-var worktreeDeny = map[string]struct{}{-	// .git-	GitDirName: {},--	// For other historical reasons, file names that do not conform to the 8.3-	// format (up to eight characters for the basename, three for the file-	// extension, certain characters not allowed such as `+`, etc) are associated-	// with a so-called "short name", at least on the `C:` drive by default.-	// Which means that `git~1/` is a valid way to refer to `.git/`.-	"git~1": {},-}--// validPath checks whether paths are valid.-// The rules around invalid paths could differ from upstream based on how-// filesystems are managed within go-git, but they are largely the same.-//-// For upstream rules:-// https://github.com/git/git/blob/564d0252ca632e0264ed670534a51d18a689ef5d/read-cache.c#L946-// https://github.com/git/git/blob/564d0252ca632e0264ed670534a51d18a689ef5d/path.c#L1383-func validPath(paths ...string) error {-	for _, p := range paths {-		parts := strings.FieldsFunc(p, func(r rune) bool { return (r == '\\' || r == '/') })-		if len(parts) == 0 {-			return fmt.Errorf("invalid path: %q", p)-		}--		if _, denied := worktreeDeny[strings.ToLower(parts[0])]; denied {-			return fmt.Errorf("invalid path prefix: %q", p)-		}--		if runtime.GOOS == "windows" {-			// Volume names are not supported, in both formats: \\ and <DRIVE_LETTER>:.-			if vol := filepath.VolumeName(p); vol != "" {-				return fmt.Errorf("invalid path: %q", p)-			}--			if !windowsValidPath(parts[0]) {-				return fmt.Errorf("invalid path: %q", p)-			}-		}--		for _, part := range parts {-			if part == ".." {-				return fmt.Errorf("invalid path %q: cannot use '..'", p)-			}-		}-	}-	return nil-}--// windowsPathReplacer defines the chars that need to be replaced-// as part of windowsValidPath.-var windowsPathReplacer *strings.Replacer--func init() {-	windowsPathReplacer = strings.NewReplacer(" ", "", ".", "")-}--func windowsValidPath(part string) bool {-	if len(part) > 3 && strings.EqualFold(part[:4], GitDirName) {-		// For historical reasons, file names that end in spaces or periods are-		// automatically trimmed. Therefore, `.git . . ./` is a valid way to refer-		// to `.git/`.-		if windowsPathReplacer.Replace(part[4:]) == "" {-			return false-		}--		// For yet other historical reasons, NTFS supports so-called "Alternate Data-		// Streams", i.e. metadata associated with a given file, referred to via-		// `<filename>:<stream-name>:<stream-type>`. There exists a default stream-		// type for directories, allowing `.git/` to be accessed via-		// `.git::$INDEX_ALLOCATION/`.-		//-		// For performance reasons, _all_ Alternate Data Streams of `.git/` are-		// forbidden, not just `::$INDEX_ALLOCATION`.-		if len(part) > 4 && part[4:5] == ":" {

 func expand_ref(s storer.ReferenceStorer, ref plumbing.ReferenceName) (*plumbing.Reference, error) {

+	"fmt"+	"os"+	"path/filepath"+	"sort"+	"strings"+	"testing"++	billy "github.com/go-git/go-billy/v5"+	"github.com/go-git/go-billy/v5/memfs"+	"github.com/go-git/go-billy/v5/osfs"+	"github.com/go-git/go-billy/v5/util"+	"github.com/stretchr/testify/assert"+	"github.com/stretchr/testify/require"++	"github.com/go-git/go-git/v5/plumbing"+	"github.com/go-git/go-git/v5/plumbing/filemode"+	"github.com/go-git/go-git/v5/plumbing/object"+	"github.com/go-git/go-git/v5/plumbing/storer"+)++// TestForceCheckoutReplacesLeadingSymlink covers the symlink-mask bypass+// (CVE-2021-21300 class). A symlink "s" pointing at a dangerous directory+// is present in the worktree, planted by an attacker or left by an earlier+// checkout step, and the commit being force-checked-out writes a file at+// "s/<leaf>". That path string is innocent (no ".git" or ".." component),+// so string validation alone lets it through. Following the symlink would+// let the write escape the worktree.+//+// Matching upstream Git's create_directories, a force checkout must remove+// the blocking symlink and materialise a real directory, writing the file+// safely inside the worktree. Each case asserts the checkout succeeds, the+// dangerous target is untouched, and the file lands in the worktree+// instead.+func TestForceCheckoutReplacesLeadingSymlink(t *testing.T) {+	if testing.Short() {+		t.Skip("skipping symlink-mask path validation test in short mode")+	}+	t.Parallel()++	const exploit = "exploit"++	cases := []struct {+		name string+		// setup returns the symlink target (the on-disk contents of the+		// planted symlink "s"), the tree path the attack commit writes,+		// and the on-disk location that path resolves to if "s" is+		// followed.+		setup func(t *testing.T, repoDir string) (linkTarget, entryPath, escapePath string)+	}{+		{+			name: "masks .git config",+			setup: func(_ *testing.T, repoDir string) (string, string, string) {+				return ".git", "s/config", filepath.Join(repoDir, ".git", "config")+			},+		},+		{+			name: "masks .git hook",+			setup: func(_ *testing.T, repoDir string) (string, string, string) {+				return ".git", "s/hooks/pre-commit", filepath.Join(repoDir, ".git", "hooks", "pre-commit")+			},+		},+		{+			name: "masks parent dir",+			setup: func(_ *testing.T, repoDir string) (string, string, string) {+				return "..", "s/escape", filepath.Join(filepath.Dir(repoDir), "escape")+			},+		},+		{+			name: "masks absolute external dir",+			setup: func(t *testing.T, _ string) (string, string, string) {+				escape := t.TempDir()+				return escape, "s/escape", filepath.Join(escape, "escape")+			},+		},+	}++	for _, tc := range cases {+		t.Run(tc.name, func(t *testing.T) {+			t.Parallel()++			dir := t.TempDir()++			r, err := PlainInit(dir, false)+			require.NoError(t, err)+

+// worktreeFilesystem wraps a billy.Filesystem and validates every path it+// is handed, so worktree operations cannot use dangerous paths at the+// boundary. Two layers apply:+//+//   - validPath rejects dangerous path *strings*: .git and its HFS+/NTFS+//     variants, "..", control characters, volume names.+//   - validNoLeadingSymlink rejects paths whose leading directories+//     already exist on disk as symlinks, so a write or delete cannot+//     follow a planted link out of the tree.+//+// Both layers run on every mutating operation (validWritePath) and every+// read (validReadPath). Chroot additionally refuses a symlink as the final+// component, so a sub-filesystem such as a submodule worktree cannot be+// scoped to a redirected target.+//+// The wrapper intentionally stops at leading-component traversal. Callers+// that need final-component no-follow semantics for materialisation+// (checkoutFile) enforce that directly by removing the blocking symlink+// before opening the destination path. type worktreeFilesystem struct { 	billy.Filesystem 	protectNTFS bool@@ -50,7 +65,7 @@ func newWorktreeFilesystem(fs billy.Filesystem, protectNTFS, protectHFS bool) *w }  func (sfs *worktreeFilesystem) Create(filename string) (billy.File, error) {-	if err := sfs.validPath(filename); err != nil {+	if err := sfs.validWritePath(filename); err != nil { 		return nil, fmt.Errorf("create: %w", err) 	} 	return sfs.Filesystem.Create(filename)@@ -64,7 +79,7 @@ func (sfs *worktreeFilesystem) Open(filename string) (billy.File, error) { }  func (sfs *worktreeFilesystem) OpenFile(filename string, flag int, perm os.FileMode) (billy.File, error) {-	if err := sfs.validPath(filename); err != nil {+	if err := sfs.validWritePath(filename); err != nil { 		return nil, fmt.Errorf("openfile: %w", err) 	} 	return sfs.Filesystem.OpenFile(filename, flag, perm)@@ -78,14 +93,14 @@ func (sfs *worktreeFilesystem) Stat(filename string) (os.FileInfo, error) { }  func (sfs *worktreeFilesystem) Remove(filename string) error {-	if err := sfs.validPath(filename); err != nil {+	if err := sfs.validWritePath(filename); err != nil { 		return fmt.Errorf("remove: %w", err) 	} 	return sfs.Filesystem.Remove(filename) }  func (sfs *worktreeFilesystem) Rename(from, to string) error {-	if err := sfs.validPath(from, to); err != nil {+	if err := sfs.validWritePath(from, to); err != nil { 		return fmt.Errorf("rename: %w", err) 	} 	return sfs.Filesystem.Rename(from, to)@@ -106,7 +121,7 @@ func (sfs *worktreeFilesystem) Lstat(filename string) (os.FileInfo, error) { }  func (sfs *worktreeFilesystem) Symlink(target, link string) error {-	if err := sfs.validPath(link); err != nil {+	if err := sfs.validWritePath(link); err != nil { 		return fmt.Errorf("symlink: %w", err) 	} 	if err := sfs.validSymlinkName(link); err != nil {@@ -131,7 +146,7 @@ func (sfs *worktreeFilesystem) MkdirAll(path string, perm os.FileMode) error { 	if path == "" || path == "." || path == "/" { 		return nil 	}-	if err := sfs.validPath(path); err != nil {+	if err := sfs.validWritePath(path); err != nil { 		return fmt.Errorf("mkdirall: %w", err) 	} 	return sfs.Filesystem.MkdirAll(path, perm)@@ -145,18 +160,39 @@ func (sfs *worktreeFilesystem) Chroot(path string) (billy.Filesystem, error) { 	if err := sfs.validReadPath(path); err != nil { 		return nil, fmt.Errorf("chroot: %w", err) 	}+	// Chroot scopes a sub-filesystem to path, so the final component must+	// be a real directory too: a symlink there would silently redirect the+	// scope (e.g. a submodule worktree) to a target outside the tree. This

 		if err := w.Filesystem.MkdirAll(name, mode); err != nil { 			return err 		}@@ -626,7 +630,70 @@ func (w *Worktree) checkoutChangeRegularFile(name string, 	return nil } +// clearBlockingSymlinks removes a symlink that is in the way of+// materialising name, so the checkout writes a real entry in its place+// instead of following the link out of the worktree. Two cases:+//+//   - a leading directory component that is a symlink (e.g. "s" while+//     writing "s/config", where "s" links to ".git"): OpenFile/MkdirAll+//     would traverse it, so the write would land under the link's target.+//   - the final component itself being a symlink (e.g. writing "s" while+//     "s" links to ".git/config"): OpenFile with O_TRUNC, or Symlink,+//     would follow/replace through it and clobber the target.+//+// A symlink can never be a legitimate parent of, or the destination for,+// a tracked entry, so removing it is always correct. This mirrors upstream+// Git's forced checkout, which unlinks a blocking symlink in the leading+// path (create_directories) and unlinks an existing entry before+// write_entry.+// https://github.com/git/git/blob/v2.54.0/entry.c#L50+func (w *Worktree) clearBlockingSymlinks(name string) error {+	var dirs []string+	for dir := filepath.Dir(name); dir != "." && dir != "" && dir != string(filepath.Separator); dir = filepath.Dir(dir) {+		dirs = append(dirs, dir)+	}+	// Leading components, shallowest-first: removing the shallowest symlink+	// invalidates every component beneath it, so a single removal is enough.+	for i := len(dirs) - 1; i >= 0; i-- {+		fi, err := w.Filesystem.Lstat(dirs[i])+		if err != nil {+			// A missing component is created as a real directory by the+			// checkout. Any other error means we cannot tell whether it is+			// a symlink, so surface it instead of leaving a blocking link in+			// place and failing later in a harder-to-diagnose way.+			if os.IsNotExist(err) {+				continue+			}+			return err+		}+		if fi.Mode()&os.ModeSymlink != 0 {+			return w.Filesystem.Remove(dirs[i])+		}+	}+	// Final component: an existing symlink here would be followed by the+	// subsequent OpenFile/Symlink/MkdirAll, so replace it.+	fi, err := w.Filesystem.Lstat(name)+	if err != nil {+		if os.IsNotExist(err) {+			return nil+		}+		return err+	}+	if fi.Mode()&os.ModeSymlink != 0 {+		return w.Filesystem.Remove(name)+	}+	return nil+}+ func (w *Worktree) checkoutFile(f *object.File) (err error) {+	// checkoutFile is the materialisation boundary for tracked entries.+	// Remove any blocking symlink first so the subsequent OpenFile or+	// Symlink call writes the entry itself instead of following a planted+	// final-component link in the underlying filesystem.+	if err := w.clearBlockingSymlinks(f.Name); err != nil {+		return err+	}+ 	mode, err := f.Mode.ToOSFileMode() 	if err != nil { 		return