fix: prevent environment expansion in remote URLs#2181
Merged
Conversation
Remote and submodule creation expanded environment-variable references in caller-supplied URLs before storing them in Git configuration. This could expose process environment values through a later network request or a tracked .gitmodules file. Preserve variables literally in the remaining untrusted URL callers while retaining Git.polish_url() expansion for intentional local-path normalization. Add regression tests covering remote configuration and submodule configuration. Git baseline: git remote add and git submodule add accept URL arguments literally; Git does not perform shell-style environment expansion on those arguments. Co-authored-by: Sebastian Thiel <[email protected]>
Byron
force-pushed
the
fix-env-var-exfiltration
branch
from
July 22, 2026 15:04
333c6ba to
8634174
Compare
Byron
marked this pull request as ready for review
July 22, 2026 15:09
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens GitPython’s remote and submodule creation paths to preserve caller-supplied environment-variable references literally (e.g. ${VAR}) instead of expanding them via os.path.expandvars, aligning with the security advisory context.
Changes:
- Disable variable/
~expansion when polishing URLs inRemote.create()by passingexpand_vars=False. - Disable variable/
~expansion when polishing URLs written into submodule config by passingexpand_vars=False. - Add regression tests covering remote creation and submodule add behavior under a patched environment.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
git/remote.py |
Prevents env/~ expansion when adding a new remote by polishing URLs with expand_vars=False. |
git/objects/submodule/base.py |
Prevents env/~ expansion when writing submodule URLs to config by polishing with expand_vars=False. |
test/test_remote.py |
Adds a regression test ensuring ${VAR} in a remote URL is not expanded during create_remote. |
test/test_submodule.py |
Adds a regression test ensuring ${VAR} in a local-path submodule URL is not expanded during Submodule.add. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tasks
This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.
Everything below this line was generated by
Codex GPT-5.Created by Codex on behalf of Byron. Byron will review before this is ready to merge.
Summary
Preserve caller-supplied environment-variable references literally when creating remotes and submodules. This closes the remaining sibling URL paths missed by the earlier clone hardening while retaining existing local-path normalization behavior.
Advisory summary
The advisory remains in triage, so reproduction and exploit details are intentionally omitted here.
Validation
git diff --check: passedmaster-branch fixture