Block separate git directories during clone

codex · Byron · commit cc9a4e0eaa0e · 2026-08-10T11:34:20.000+02:00
Repo.clone() and Repo.clone_from() did not reject the clone option that redirects repository metadata to a caller-controlled path (GHSA-8mcc-hrx5-hvxc). Regression coverage exercises both keyword and multi-option input through both public clone APIs. Add the option to the existing clone denylist, matching Repo.init() and the documented allow_unsafe_options contract. Git itself registers --separate-git-dir in builtin/clone.c and verifies the redirected metadata directory in t/t5601-clone.sh. Assisted-by: GPT 5.6 Co-authored-by: GPT 5.6 <codex@openai.com>
diff --git a/git/repo/base.py b/git/repo/base.py
@@ -159,6 +159,8 @@ class Repo:
         "-c",
         # Can install hooks that execute during clone:
         "--template",
+        # Redirects the repository metadata to a caller-controlled path:
+        "--separate-git-dir",
         # Fetches from an additional caller-controlled URI:
         "--bundle-uri",
     ]
diff --git a/test/test_clone.py b/test/test_clone.py
@@ -133,6 +133,7 @@ def test_clone_unsafe_options(self, rw_repo):
                 "-vcprotocol.ext.allow=always",
                 f"--template={tmp_dir}",
                 f"--bundle-uri=file://{tmp_dir}",
+                f"--separate-git-dir={tmp_dir / 'git-dir'}",
             ]
             for unsafe_option in unsafe_options:
                 with self.assertRaises(UnsafeOptionError):
@@ -149,6 +150,7 @@ def test_clone_unsafe_options(self, rw_repo):
                 {"c": "protocol.ext.allow=always"},
                 {"template": tmp_dir},
                 {"bundle_uri": f"file://{tmp_dir}"},
+                {"separate_git_dir": tmp_dir / "git-dir"},
             ]
             for unsafe_option in unsafe_options:
                 with self.assertRaises(UnsafeOptionError):
@@ -258,6 +260,7 @@ def test_clone_from_unsafe_options(self, rw_repo):
                 "-c protocol.ext.allow=always",
                 "-cprotocol.ext.allow=always",
                 "-vcprotocol.ext.allow=always",
+                f"--separate-git-dir={tmp_dir / 'git-dir'}",
             ]
             for unsafe_option in unsafe_options:
                 with self.assertRaises(UnsafeOptionError):
@@ -270,6 +273,7 @@ def test_clone_from_unsafe_options(self, rw_repo):
                 {"u": f"touch {tmp_file}"},
                 {"config": "protocol.ext.allow=always"},
                 {"c": "protocol.ext.allow=always"},
+                {"separate_git_dir": tmp_dir / "git-dir"},
             ]
             for unsafe_option in unsafe_options:
                 with self.assertRaises(UnsafeOptionError):

Original file line number	Diff line number	Diff line change
`@@ -159,6 +159,8 @@ class Repo:`
`159`	`159`	`"-c",`
`160`	`160`	`# Can install hooks that execute during clone:`
`161`	`161`	`"--template",`
	`162`	`+ # Redirects the repository metadata to a caller-controlled path:`
	`163`	`+ "--separate-git-dir",`
`162`	`164`	`# Fetches from an additional caller-controlled URI:`
`163`	`165`	`"--bundle-uri",`
`164`	`166`	`]`