fix: ignore includes in submodule configuration

codex · Byron · commit 5326ebf0a7a7 · 2026-08-10T12:32:24.000+02:00
Submodule configuration is read from .gitmodules, whose contents may come from an untrusted repository. Its parser inherited merge_includes=True and could therefore open files named by include directives during ordinary submodule enumeration. Disable include merging at the SubmoduleConfigParser construction site. This matches Repo.config_writer() hardening from 41ecc6a and addresses GHSA-7833-fr7j-v32q without changing include behavior for trusted config parsers. The regression points .gitmodules at a non-config file and verifies the submodule entry remains readable without opening the included path. Validation: - pytest -q test/test_submodule.py::TestSubmodule::test_gitmodules_does_not_merge_includes - pytest -q - ruff check git/objects/submodule/base.py test/test_submodule.py - ruff format --check git/objects/submodule/base.py test/test_submodule.py
diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py
@@ -270,7 +270,7 @@ def _config_parser(
             raise ValueError("Cannot write blobs of 'historical' submodule configurations")
         # END handle writes of historical submodules
 
-        return SubmoduleConfigParser(fp_module, read_only=read_only)
+        return SubmoduleConfigParser(fp_module, read_only=read_only, merge_includes=False)
 
     def _clear_cache(self) -> None:
         """Clear the possibly changed values."""
diff --git a/test/test_submodule.py b/test/test_submodule.py
@@ -1207,6 +1207,22 @@ def test_ignore_non_submodule_file(self, rwdir):
 
         assert len(parent.submodules) == 0
 
+    @with_rw_directory
+    def test_gitmodules_does_not_merge_includes(self, rwdir):
+        parent = git.Repo.init(rwdir)
+        secret_path = osp.join(rwdir, "secret")
+        with open(secret_path, "w", encoding="utf-8") as secret:
+            secret.write("not git config\n")
+        with open(osp.join(rwdir, ".gitmodules"), "w", encoding="utf-8") as modules:
+            modules.write('[submodule "module"]\n')
+            modules.write("\tpath = module\n")
+            modules.write("\turl = https://example.com/module.git\n")
+            modules.write("[include]\n")
+            modules.write("\tpath = %s\n" % secret_path)
+
+        parser = Submodule._config_parser(parent, None, read_only=True)
+        self.assertEqual(parser.get_value('submodule "module"', "path"), "module")
+
     @with_rw_directory
     def test_remove_norefs(self, rwdir):
         parent = git.Repo.init(osp.join(rwdir, "parent"))
