Repository navigation
Treat public checkout destinations as literal Git paths #158
Description
Problem
The public integration checkout helper passes its requested destination directly
to git clone without ending option parsing. During review of Sonar finding
AaFA6u0QrKpiHhFp4uxc (pythonsecurity:S8705), the emitted argument vector was
reproduced against an empty local repository: requesting destination --bare
returns success but creates a bare source.git instead of the requested working
tree. Adding Git's option terminator makes the same input a literal destination.
This is a confirmed checkout behavior problem. The reproduction does not
establish customer impact or a remote code execution exploit.
Acceptance
- Treat the destination as a literal path, including names such as
--bare
and--mirror. - Retain the public repository allowlist, disabled credential helper, exact
lowercase SHA validation and post-checkout commit verification. - Add real Git tests that verify the requested working-tree directory and
original commit, alongside the existing authority and candidate controls. - Pass repository checks. No SDK runtime, version, dependency, release or
service protocol change is needed.
Related Sonar ownership: durable-workflow/.github#187.
Activity
rmcdaniel commentedon Oct 17, 2026
Delivered through PR159,
merged as
ceb0cd79365255f5575dd745145b9af557f9d0b1with the identical reviewed5f253902tree. All ten candidate CI jobs and all ten independentmain jobs
pass, including actual HTTP integration. The official Sonar app passes on the
exact merged revision; the PR report has no open findings.
Real Git controls verify literal
--bareand--mirrordirectories in bothdefault and exact-commit modes. The original two controls fail on the parent;
the corrected checkout suite passes all 20 tests and Ruff. Public URL authority,
credential-helper disabling, SHA validation and resolved-commit checking remain
covered. No SDK runtime or released package changed, so no publication is needed.
Sonar's residual clone report on the corrected code is individually explained
as a false positive: its flow does not recognize Git's literal option terminator.
The real original behavior is fixed and its regression remains enforced. Rules,
thresholds and exclusions are unchanged. Disposable test resources are removed.