I would like to contribute a "safe mode" for working with untrusted repos

[eighthave]

For f-droid.org, we build thousands of Android apps from git repos. To reduce our attack surface and work towards "least authority", we use a custom Git wrapper that locks down a lot of things that we never need, and have a higher risk of vulnerabilities. I would like to rework this to be a part of GitPython. So I'm opening this issue to see if this is something that the GitPython maintainers would be interested in merging.

I'm open on the API, it could be something like this:

git_repo = git.repo.Repo('.', safe=True)

The goal would be then that all invocations of Git would include these kinds options:

core.askpass = /bin/true
core.hooksPath = /dev/null
protocol.allow = never
protocol.https.allow = always
core.sshCommand = /bin/false
url.https://.insteadOf = ssh://

And run with these env vars:

GIT_TERMINAL_PROMPT=0
GIT_ASKPASS=/bin/true
SSH_ASKPASS=/bin/true
GIT_SSH=/bin/false  # for git < 2.3

This then hopefully only allows unauthenticated access to HTTPS repos, and prevents the execution of any command besides git. This would eliminate risks like these:

• GHSA-2mqj-m65w-jghx
• https://stackoverflow.com/questions/74200395/is-it-dangerous-to-open-or-clone-a-git-repository-from-an-untrusted-source
• GHSA-vm9j-46j9-qvq4
• https://git-scm.com/docs/git#_security
• https://github.blog/open-source/git/securing-git-addressing-5-new-vulnerabilities/
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000117

[Byron]

This sounds like a very nice feature to have, and one that wouldn't affect anyone who didn't opt in to.

Yes, a PR would definitely be welcome.

[Kilo59]

Related question, is there a way to set the equivalent of GIT_TERMINAL_PROMPT=0 purely within gitpython (without setting an env var)?

[eighthave]

GIT_TERMINAL_PROMPT=0 is functionally equivalent to core.askpass = /bin/true as far as I understand it. The env vars can override the config values, so I want to set the env vars to make sure that the config values are never overridden.

There is another thing that we use which is hard to generalize. The core goal is to rewrite all remote URLs to https://, whenever possible, then only support https as a protocol. This is necessary to support submodules when using this "safe" mode. ssh:// URLs are easy to handle (url.https://.insteadOf = ssh://), but the rest are not. This is the best I could come up with:

        for domain in ('bitbucket.org', 'github.com', 'gitlab.com', 'codeberg.org'):
            config.append(f'url.https://u:p@{domain}/.insteadOf=git@{domain}:')
            config.append(f'url.https://u:p@{domain}.insteadOf=git://{domain}')
            config.append(f'url.https://u:p@{domain}.insteadOf=https://{domain}')

Anyone know a way to generalize those insteadOf rules to any domain?

[Byron]

This seems to be the code handling the rewrites in Git - maybe from there it becomes clear how it can be used more generally?

Maybe it's the the code that parses the configuration that limits what it can do though.