Matt Van Horn
9f66e428f8
fix: resolve core.excludesFile only from user-owned global git configs
...
Drop the repo-local .git/config pass in resolve_global_excludes_path() so
an untrusted repo cannot point core.excludesFile at an arbitrary file (e.g.
~/.ssh/id_rsa) and have cbm open and read it merely by being indexed. git is
safe here because it only trusts a repo's .git/config after a deliberate
clone/init; the indexer has no such trust step. Global excludes now resolve
only from the user-owned ~/.gitconfig and $XDG_CONFIG_HOME/git/config. A
repo's own ignores remain handled by .gitignore / .cbmignore.
Add a guard test asserting a repo-local .git/config whose excludesFile points
outside the repo is ignored, not read.
Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com >
2026-06-22 14:39:26 -07:00
..
2026-06-05 21:53:25 +02:00
2026-06-05 21:53:25 +02:00
2026-03-22 18:33:10 -05:00
2026-03-15 22:37:34 +01:00
2026-05-30 18:26:44 +02:00
2026-04-15 23:56:03 +02:00
2026-06-05 21:53:25 +02:00
2026-06-05 21:53:25 +02:00
2026-04-01 23:22:44 +02:00
2026-06-07 18:29:05 +02:00
2026-06-06 22:16:04 +02:00
2026-06-05 21:53:25 +02:00
2026-05-19 22:47:53 +02:00
2026-06-02 18:50:55 +02:00
2026-06-22 14:39:26 -07:00
2026-03-25 09:28:11 +01:00
2026-06-07 13:00:55 +02:00
2026-06-07 13:00:55 +02:00
2026-06-07 14:16:36 +02:00
2026-06-07 12:35:53 +02:00
2026-06-08 22:55:23 +02:00
2026-06-09 14:32:26 +02:00
2026-05-31 17:22:02 +02:00
2026-06-05 21:53:25 +02:00
2026-03-19 02:58:03 +01:00
2026-03-15 22:37:34 +01:00
2026-06-05 21:53:25 +02:00
2026-06-12 02:17:39 +02:00
2026-06-07 19:13:01 +02:00
2026-06-07 19:13:01 +02:00
2026-06-07 19:13:01 +02:00
2026-06-07 20:05:24 +02:00
2026-06-07 20:05:24 +02:00
2026-06-07 20:05:24 +02:00
2026-06-08 22:55:23 +02:00
2026-06-12 02:17:39 +02:00
2026-03-24 23:48:23 +01:00
2026-05-21 22:52:16 +02:00
2026-03-31 20:04:11 +02:00
2026-06-12 02:17:25 +02:00
2026-06-05 21:53:25 +02:00
2026-03-15 19:26:12 +01:00
2026-06-06 22:16:04 +02:00
2026-06-02 18:52:37 +02:00
2026-06-02 18:52:37 +02:00
2026-06-03 01:33:25 +02:00
2026-06-12 02:17:39 +02:00
2026-06-12 02:17:39 +02:00
2026-06-06 22:30:38 +02:00
2026-06-07 14:16:36 +02:00
2026-03-15 22:37:34 +01:00
2026-06-12 02:17:25 +02:00
2026-06-08 22:55:23 +02:00
2026-06-07 18:29:05 +02:00
2026-06-01 22:53:17 +02:00
2026-06-05 21:53:25 +02:00
2026-06-12 02:17:39 +02:00
2026-06-05 21:53:25 +02:00
2026-06-06 22:30:38 +02:00
2026-05-29 04:20:20 +02:00
2026-05-09 16:05:45 +02:00
2026-06-10 13:44:09 +02:00
2026-05-30 20:15:30 +02:00
2026-06-05 21:53:25 +02:00
2026-05-09 15:44:09 +02:00
2026-05-09 14:16:15 +02:00
2026-05-31 03:14:17 +02:00
2026-06-09 21:53:26 +02:00
2026-06-03 02:13:30 +02:00
2026-05-08 22:26:56 +02:00
2026-05-10 20:43:45 +02:00
2026-06-05 21:53:25 +02:00
2026-06-10 16:42:20 +02:00
2026-06-10 13:03:00 +02:00
2026-06-09 23:07:47 +02:00
2026-03-20 20:32:38 +01:00
2026-05-29 03:37:56 +02:00
2026-03-24 23:48:23 +01:00
2026-05-31 12:50:19 +02:00
2026-05-29 03:37:56 +02:00
2026-05-31 11:48:25 +02:00
2026-03-24 23:48:23 +01:00
2026-03-25 09:47:59 +01:00
2026-03-24 23:48:23 +01:00
2026-06-12 10:51:11 +02:00
2026-06-10 12:11:02 +02:00
2026-04-01 23:22:44 +02:00
2026-04-06 14:34:07 +02:00
2026-06-05 21:53:25 +02:00
2026-06-06 18:36:28 +02:00
2026-06-06 19:48:48 +02:00
2026-03-24 23:48:23 +01:00
2026-04-15 23:56:03 +02:00