GitoxideLabs/gitoxide gix-sec-v0.12.1

gix-sec v0.12.1

on GitHub

Bug Fixes

• consider a Windows resource untrusted if security information could not be retrieved
  Here is the full text of the analysis by Eliah Kagan:

  ---

  Although I'm signed in to Discord, I'm not able to access the linked Discord chat. But from the task list in #2129, it looks like the problem underlying this issue is that, unlike files and directories accessed through SMB shares, Windows does not make security information available on files and directories accessed (on the Windows side) through 9P shares.

  Support for 9P shares was added to Windows to implement shares that access files in installed WSL distributions. These are shares named like \\wsl$\distro or \\wsl.localhost\distro, where distro is the distribution. Currently 9P is supported on Windows only for such WSL shares (though I don't know if being intended only for this WSL-related use is the reason security information isn't available through them).

  This is the case whether the 9P share is accessed through a \\ path (e.g., \\share\name, \\?\UNC\share\name) or mapped to a drive letter. It is not specific to mapped drive letters, nor to any particular technique of mapping a share (or other directory) to a drive letter. So the claim that this depends on how the path is mounted is either accurate or inaccurate depending on exactly what is meant by it.

  Consider my Windows 10 system, on which the drive letters Y: and Z: (ignore X:) are currently mapped as:

  C:\Users\ek> net use
  New connections will be remembered.
  
  Status       Local     Remote                    Network
  
  -------------------------------------------------------------------------------
  Disconnected X:        \\localhost\C$            Microsoft Windows Network
  OK           Y:        \\kip\ek                  Microsoft Windows Network
               Z:        \\wsl$\Ubuntu             Plan 9 Network Provider
  The command completed successfully.
  

  In this experimental setup, subdirectories \\kip\ek\temporary and \\wsl$\Ubuntu\home\ek\temporary both exist, and they are both accessible. (These are separate directories on separate systems. They both have same name temporary in connection with more systematic testing I've been doing; I hope that's not too confusing.) Each is accessible through the \\ paths or mounted drive letters.

  The SMB ("Microsoft Windows Network") share is accessible:

  C:\Users\ek> Get-Item \\kip\ek\temporary
  
      Directory: \\kip\ek
  
  Mode                 LastWriteTime         Length Name
  ----                 -------------         ------ ----
  d----           6/28/2025  2:51 AM                temporary
  
  

Commit Statistics

• 12 commits contributed to the release over the course of 99 calendar days.
• 99 days passed between releases.
• 1 commit was understood as conventional.
• 1 unique issue was worked on: #2128

Commit Details