GitoxideLabs/gitoxide gix-fs-v0.24.1

gix-fs v0.24.1

on GitHub

Bug Fixes

• guard indirect Windows symlink targets before probing

  GHSA-xw69-xv93-5fjv reports that Windows target-type probes can disclose
  credentials when a checkout symlink resolves to a network location. The
  existing leading-separator guard covers direct targets, but a local alias
  can reach the same location through an intermediate or terminal link.

  Resolve target components with no-follow metadata and inspect each reparse
  point's link target before continuing. Apply the separator guard at every
  step and reject non-disk namespaces. Bound chain resolution so missing and
  cyclic targets retain the existing retry and dangling-file behavior. This
  preserves ordinary directory-link chains without delegating untrusted
  chain traversal to a target-following metadata query. As elsewhere in
  checkout, checked directories must not be concurrently replaced.

  The regression uses a local rooted directory as a stand-in for a remote
  target, covering terminal and intermediate links through both creation
  APIs without network access. Before the fix it fails because the target
  is followed and a directory link is created; afterward file links are
  created immediately.

  The Git reference at <win-machine-path>, commit
  cc4dbf752a05efdc0e04e71fd3e8110d11bdd35c, guards direct leading separators
  in compat/mingw.c::process_phantom_symlink(). Extend that policy to
  indirect targets. Existing checkout-chain comparisons pass against
  git version 2.55.0.windows.3.

• avoid probing slash-prefixed symlink targets on Windows

  Windows symlink creation inferred the target type with a filesystem probe.
  Git for Windows guards that probe because a leading slash or backslash can
  introduce a network share, including UNC and NT namespace spellings, whose
  resolution could disclose credentials.

  Match process_phantom_symlink() in Git's compat/mingw.c by checking the
  original target spelling before probing it and creating a file link for
  these targets. Relative and drive-qualified local targets retain directory
  detection. This also deliberately treats drive-less rooted and verbatim
  local targets as files, matching the conservative Git rule.

  The regression uses only local directories with slash, backslash, and
  verbatim spellings. It fails before the guard and passes afterward. This
  is a focused safety hardening based on source review.

New Features

• add clear_readonly_attribute() for Windows read-only files

  Windows prevents removing or replacing files with the read-only attribute
  set. Centralize clearing that attribute in gix-fs instead of repeating
  the permission handling in worktree removal and tests.

  clear_readonly_attribute() follows symbolic links and clears the
  attribute only when set, propagating I/O errors. On other platforms it
  returns success without accessing the path or changing permissions.

  Use the helper for the existing worktree-removal retry and for cleanup
  in the tempfile and configuration permission-preservation tests.

Commit Statistics

• 9 commits contributed to the release over the course of 14 calendar days.
• 14 days passed between releases.
• 3 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details