fix: preserve multiline config values when writing

<!-- agent -->
GitConfigParser decoded valid multiline values into embedded newlines, but
_write() serialized those newlines as indented physical lines. Rewriting an
otherwise unchanged config could therefore change its meaning to Git.

Serialize resident multiline values with Git-compatible escapes inside a
quoted continuation, preserving GitPython read compatibility while keeping
each option structurally intact. This addresses GHSA-284h-m62q-gf8w.

The regression starts with an inert multiline value, performs an unrelated
write, and verifies with both GitPython and git config that it remains one
value and does not create another option.

Git baseline: config.c parse_value() and write_pair() at cf5497b14c5a escape
embedded LF as \\n rather than emitting it as a physical config line.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

Author: Byron

git/config.py

@@ -705,7 +705,11 @@ def write_section(name: str, section_dict: _OMD) -> None:
                     continue
 
                 for v in values:
-                    fp.write(("\t%s = %s\n" % (key, self._value_to_string(v).replace("\n", "\n\t"))).encode(defenc))
+                    value = self._value_to_string(v)
+                    if any(char in value for char in '\n\t\b\\"'):
+                        value = value.replace("\\", "\\\\").replace('"', '\\"')
+                        value = '"%s\\\n"' % value.replace("\n", "\\n").replace("\t", "\\t").replace("\b", "\\b")
+                    fp.write(("\t%s = %s\n" % (key, value)).encode(defenc))
                 # END if key is not __name__
 
         # END section writing

test/test_config.py

@@ -7,6 +7,7 @@
 import io
 import os
 import os.path as osp
+import subprocess
 import sys
 from unittest import mock
 
@@ -15,7 +16,6 @@
 from git import GitConfigParser
 from git.config import _OMD, cp
 from git.util import cwd, rmfile
-
 from test.lib import SkipTest, TestCase, fixture_path, with_rw_directory
 
 _tc_lock_fpaths = osp.join(osp.dirname(__file__), "fixtures/*.lock")
@@ -150,6 +150,46 @@ def test_config_value_with_trailing_new_line(self):
         git_config = GitConfigParser(config_file)
         git_config.read()  # This should not throw an exception
 
+    @with_rw_directory
+    def test_rewriting_multiline_value_does_not_create_option(self, rw_dir):
+        config_path = osp.join(rw_dir, "config")
+        with open(config_path, "wb") as config_file:
+            config_file.write(b'[core]\n\tzzz = "A\\nhooksPath = ../evil-hooks\\\n"\n')
+
+        with GitConfigParser(config_path, read_only=False) as git_config:
+            self.assertEqual(git_config.get_value("core", "zzz"), "A\nhooksPath = ../evil-hooks")
+            git_config.set_value("user", "name", "Test User")
+
+        with GitConfigParser(config_path, read_only=True) as git_config:
+            self.assertEqual(git_config.get_value("core", "zzz"), "A\nhooksPath = ../evil-hooks")
+            self.assertFalse(git_config.has_option("core", "hooksPath"))
+        self.assertEqual(
+            subprocess.run(["git", "config", "--file", config_path, "--get", "core.hooksPath"]).returncode, 1
+        )
+
+    @with_rw_directory
+    def test_writer_escapes_special_characters_without_newline(self, rw_dir):
+        config_path = osp.join(rw_dir, "config")
+        values = {"tab": "\tvalue\t", "backspace": "a\bb", "quote": 'a"b', "backslash": "a\\qb"}
+
+        with GitConfigParser(config_path, read_only=False) as git_config:
+            for key, value in values.items():
+                git_config.set_value("section", key, value)
+
+        with GitConfigParser(config_path, read_only=True) as git_config:
+            for key, value in values.items():
+                self.assertEqual(git_config.get_value("section", key), value)
+                self.assertEqual(
+                    subprocess.run(
+                        ["git", "config", "--file", config_path, "--get", "section.%s" % key],
+                        stdout=subprocess.PIPE,
+                        check=True,
+                    ).stdout,
+                    value.encode() + b"\n",
+                )
+        with open(config_path, "rb") as config_file:
+            self.assertNotIn(b"\x08", config_file.read())
+
     @with_rw_directory
     def test_set_value_rejects_config_injection(self, rw_dir):
         config_path = osp.join(rw_dir, "config")