Sebastion 12bc86d9c9 fix: prevent path traversal in .worktreeinclude file processing ...

Resolve .worktreeinclude entries and validate that both the source path
stays within the repository root and the destination path stays within
the worktree directory before copying files or creating symlinks.

A malicious .worktreeinclude in a cloned repository could previously
reference paths like "../../etc/passwd" to copy or symlink arbitrary
files from outside the repo into the worktree.

CWE-22: Improper Limitation of a Pathname to a Restricted Directory

2026-03-14 21:48:19 -07:00

270 KiB

Executable File

Raw Blame History

View Raw