Block separate git directories during clone

[Byron]

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

• refackiew

---

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Advisory

GHSA-8mcc-hrx5-hvxc

GHSA-8mcc-hrx5-hvxc reports that clone operations do not classify --separate-git-dir as unsafe. This change adds it to the existing clone option denylist, matching the init guard and the documented allow_unsafe_options contract.

Advisory summary

• Severity: High
• Package: GitPython (pip)
• Affected versions: <= 3.1.58
• Patched version: not yet assigned
• CVE: not yet assigned

Validation

• test/test_clone.py: 21 passed, 1 skipped
• Regression coverage includes both Repo.clone() and Repo.clone_from(), through keyword and multi-option inputs.
• Git baseline: builtin/clone.c registers the option and t/t5601-clone.sh verifies redirected metadata behavior.

[Copilot]

Pull request overview

This PR addresses GHSA-8mcc-hrx5-hvxc by treating git clone --separate-git-dir (and its kwarg form separate_git_dir) as an unsafe option unless allow_unsafe_options=True, aligning clone behavior with the existing init guard and the documented unsafe-options contract.

Changes:

• Added --separate-git-dir to Repo.unsafe_git_clone_options so clone operations block separate git directories by default.
• Updated submodule clone internals to continue using separate_git_dir safely when needed while still enforcing the unsafe-options denylist for caller-supplied options.
• Expanded clone-related tests to cover the new unsafe option (multi-options and kwargs) and adjusted a submodule test to explicitly allow unsafe options when intentionally using separate_git_dir.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
git/repo/base.py	Adds --separate-git-dir to the clone unsafe-option denylist.
git/objects/submodule/base.py	Ensures submodule cloning can still use separate_git_dir internally while validating caller-provided options.
test/test_clone.py	Adds regression cases asserting clone/clone_from reject --separate-git-dir and separate_git_dir by default.
test/test_submodule.py	Updates a test to explicitly allow unsafe options when using separate_git_dir, keeping focus on submodule-name validation.

Suppressed comments (2)

test/test_clone.py:264

• To ensure long-option abbreviations are also blocked for --separate-git-dir, add an abbreviated spelling to this unsafe multi_options list.

                "--config=protocol.ext.allow=always",
                "-c protocol.ext.allow=always",
                "-cprotocol.ext.allow=always",
                "-vcprotocol.ext.allow=always",
                f"--separate-git-dir={tmp_dir / 'git-dir'}",
            ]

test/test_clone.py:277

• This kwargs-based unsafe-options test should also cover abbreviated keyword spellings for separate_git_dir (e.g., separate_git_di) so the clone_from path matches the clone path coverage.

                {"upload_pack": f"touch {tmp_file}"},
                {"u": f"touch {tmp_file}"},
                {"config": "protocol.ext.allow=always"},
                {"c": "protocol.ext.allow=always"},
                {"separate_git_dir": tmp_dir / "git-dir"},
            ]

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.