GHSA-3RP5-JJMW-4WV2

--- a/git/config.py+++ b/git/config.py@@ -72,6 +72,9 @@ CONDITIONAL_INCLUDE_REGEXP = re.compile(r"(?<=includeIf )\"(gitdir|gitdir/i|onbr See: https://git-scm.com/docs/git-config#_conditional_includes """ +UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]")+"""Characters that cannot be safely written in config names or values."""+  class MetaParserBuilder(abc.ABCMeta): # noqa: B024 """Utility class wrapping base-class methods into decorators that assure read-only@@ -778,6 +781,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):  def add_section(self, section: "cp._SectionName") -> None: """Assures added options will stay in order."""+ self._assure_config_name_safe(section, "section") return super().add_section(section)  @property@@ -884,10 +888,14 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):  def _value_to_string_safe(self, value: Union[str, bytes, int, float, bool]) -> str: value_str = self._value_to_string(value)- if re.search(r"[\r\n\x00]", value_str):+ if UNSAFE_CONFIG_CHARS_RE.search(value_str): raise ValueError("Git config values must not contain CR, LF, or NUL") return value_str + def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None:+ if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):+ raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label)+ @needs_values @set_dirty_and_flush_changes def set(@@ -896,6 +904,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): option: str, value: Union[str, bytes, int, float, bool, None] = None, ) -> None:+ self._assure_config_name_safe(section, "section")+ self._assure_config_name_safe(option, "option") if value is not None: value = self._value_to_string_safe(value) return super().set(section, option, value)@@ -920,6 +930,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): :return: This instance """+ self._assure_config_name_safe(section, "section")+ self._assure_config_name_safe(option, "option") value_str = self._value_to_string_safe(value) if not self.has_section(section): self.add_section(section)@@ -948,6 +960,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): :return: This instance """+ self._assure_config_name_safe(section, "section")+ self._assure_config_name_safe(option, "option") value_str = self._value_to_string_safe(value) if not self.has_section(section): self.add_section(section)@@ -968,6 +982,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): """ if not self.has_section(section): raise ValueError("Source section '%s' doesn't exist" % section)+ self._assure_config_name_safe(new_name, "section") if self.has_section(new_name): raise ValueError("Destination section '%s' already exists" % new_name) 

--- a/test/test_config.py+++ b/test/test_config.py@@ -163,6 +163,37 @@ class TestBase(TestCase): self.assertFalse(git_config.has_section("user")) self.assertFalse(git_config.has_section("core")) + @with_rw_directory+ def test_set_value_rejects_unsafe_section_and_option_names(self, rw_dir):+ config_path = osp.join(rw_dir, "config")+ bad_keys = ("user]\n[core", "user]\r[core", "user]\x00[core")++ with GitConfigParser(config_path, read_only=False) as git_config:+ git_config.add_section("user")+ for bad_key in bad_keys:+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.add_section(bad_key)+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.set(bad_key, "hooksPath", "/tmp/hooks")+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.set("user", bad_key, "/tmp/hooks")+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.set_value(bad_key, "hooksPath", "/tmp/hooks")+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.set_value("user", bad_key, "/tmp/hooks")+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.add_value(bad_key, "hooksPath", "/tmp/hooks")+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.add_value("user", bad_key, "/tmp/hooks")+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.rename_section("user", bad_key)++ git_config.set_value("user", "name", "safe")++ with GitConfigParser(config_path, read_only=True) as git_config:+ self.assertEqual(git_config.get_value("user", "name"), "safe")+ self.assertFalse(git_config.has_section("core"))+ @with_rw_directory def test_set_and_add_value_reject_unsafe_value_characters(self, rw_dir): config_path = osp.join(rw_dir, "config")

--- a/git/config.py+++ b/git/config.py@@ -897,6 +897,22 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label)+ if label == "section" and isinstance(name, str):+ in_quotes = False+ escaped = False+ for index, char in enumerate(name):+ if escaped:+ escaped = False+ elif in_quotes and char == "\\":+ escaped = True+ elif char == '"':+ if not in_quotes and (index == 0 or name[index - 1] not in " \t"):+ raise ValueError("Git config quoted subsection names must begin after whitespace")+ in_quotes = not in_quotes+ elif char == "]" and not in_quotes:+ raise ValueError("Git config section names must not contain an unquoted closing bracket")+ if in_quotes:+ raise ValueError("Git config section names must not contain an unterminated quote")  @needs_values @set_dirty_and_flush_changes

--- a/test/test_config.py+++ b/test/test_config.py@@ -194,6 +194,53 @@ class TestBase(TestCase): self.assertEqual(git_config.get_value("user", "name"), "safe") self.assertFalse(git_config.has_section("core")) + @with_rw_directory+ def test_writer_rejects_unquoted_section_terminators(self, rw_dir):+ config_path = osp.join(rw_dir, "config")+ bad_sections = (+ "user] [other",+ 'user"] [other"',+ 'submodule "docs"] [other',+ 'submodule "docs] [other',+ 'submodule "docs] [other\\',+ )+ safe_section = 'submodule "docs]archive"'++ with GitConfigParser(config_path, read_only=False) as git_config:+ git_config.add_section("user")+ for bad_section in bad_sections:+ with pytest.raises(ValueError, match="section name"):+ git_config.add_section(bad_section)+ with pytest.raises(ValueError, match="section name"):+ git_config.set(bad_section, "name", "value")+ with pytest.raises(ValueError, match="section name"):+ git_config.set_value(bad_section, "name", "value")+ with pytest.raises(ValueError, match="section name"):+ git_config.add_value(bad_section, "name", "value")+ with pytest.raises(ValueError, match="section name"):+ git_config.rename_section("user", bad_section)++ git_config.set_value("user", "name", "safe")+ git_config.set_value(safe_section, "name", "safe")+ self.assertEqual(git_config.get_value(safe_section, "name"), "safe")++ # A closing bracket inside a quoted subsection name is data, not a section terminator.+ with open(config_path, "rb") as config_file:+ self.assertIn(+ b'[submodule "docs]archive"]\n',+ config_file.read(),+ "a closing bracket within a quoted subsection name should be preserved",+ )++ # Reparse the file to verify that rejected names did not inject an [other] section.+ with GitConfigParser(config_path, read_only=True) as git_config:+ self.assertEqual(+ git_config.get_value("user", "name"),+ "safe",+ "rejected section names corrupted the existing section",+ )+ self.assertFalse(git_config.has_section("other"), "an unsafe section name injected an [other] section")+ @with_rw_directory def test_set_and_add_value_reject_unsafe_value_characters(self, rw_dir): config_path = osp.join(rw_dir, "config")