Skip to content

Bound worktree .git and commondir reads during repository resolution #2858

Description

@Widthdom

Problem

src/CodeIndex/Cli/GitHelper.cs resolves linked worktrees by reading .git and commondir files with File.ReadAllText and no size check.

Impact

A malformed checkout or attacker-controlled workspace can make repository resolution allocate large buffers before normal git safeguards run.

Expected

Treat these metadata files as tiny control files: check length before reading, reject oversized content, and keep the existing linked-worktree behavior for valid files.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions