Validate repository-relative index paths

Author: codex

git/index/base.py

@@ -34,6 +34,8 @@
     LockedFD,
     join_path_native,
     file_contents_ro,
+    _is_path_rooted,
+    _to_relative_path,
     to_native_path_linux,
     unbare_repo,
     to_bin_sha,
@@ -58,6 +60,7 @@
     Any,
     BinaryIO,
     Callable,
+    cast,
     Dict,
     Generator,
     IO,
@@ -655,16 +658,12 @@ def _to_relative_path(self, path: PathLike) -> PathLike:
 
         :raise ValueError:
         """
-        if not osp.isabs(path):
-            return path
         if self.repo.bare:
-            raise InvalidGitRepositoryError("require non-bare repository")
-        if not osp.normpath(path).startswith(str(self.repo.working_tree_dir)):
-            raise ValueError("Absolute path %r is not in git repository at %r" % (path, self.repo.working_tree_dir))
-        result = os.path.relpath(path, self.repo.working_tree_dir)
-        if os.fspath(path).endswith(os.sep) and not result.endswith(os.sep):
-            result += os.sep
-        return result
+            drive, _tail = osp.splitdrive(os.fspath(path))
+            if drive or _is_path_rooted(path):
+                raise InvalidGitRepositoryError("require non-bare repository")
+            return path
+        return _to_relative_path(cast(PathLike, self.repo.working_tree_dir), path)
 
     def _preprocess_add_items(
         self, items: Union[PathLike, Sequence[Union[PathLike, Blob, BaseIndexEntry, "Submodule"]]]

git/util.py

@@ -315,6 +315,46 @@ def join_path_native(a: PathLike, *p: PathLike) -> PathLike:
     return to_native_path(join_path(a, *p))
 
 
+def _is_path_rooted(path: PathLike) -> bool:
+    """Whether ``path`` has a root, including a Windows path without a drive."""
+    _drive, tail = osp.splitdrive(os.fspath(path))
+    separators = (os.sep,) if os.altsep is None else (os.sep, os.altsep)
+    return tail.startswith(separators)
+
+
+def _to_relative_path(root: PathLike, path: PathLike) -> str:
+    r"""Return a normalized Git-style path confined to ``root``.
+
+    A Windows path such as ``\directory`` is rooted but not absolute. Resolve it
+    against the drive of ``root`` rather than treating it as relative to ``root``.
+    Drive-relative paths such as ``C:directory`` are rejected because their meaning
+    depends on process-global per-drive state.
+    """
+    path_str = os.fspath(path)
+    if not path_str:
+        return path_str
+
+    drive, _tail = osp.splitdrive(path_str)
+    rooted = _is_path_rooted(path_str)
+    if drive and not rooted:
+        raise ValueError("Drive-relative path %r is not supported" % path_str)
+
+    root_abs = osp.abspath(os.fspath(root))
+    path_abs = osp.abspath(osp.join(root_abs, path_str))
+    try:
+        common_path = osp.commonpath([root_abs, path_abs])
+    except ValueError as e:
+        raise ValueError("Path %r is not in repository at %r" % (path_str, root_abs)) from e
+    if osp.normcase(common_path) != osp.normcase(root_abs):
+        raise ValueError("Path %r is not in repository at %r" % (path_str, root_abs))
+
+    relative_path = to_native_path_linux(osp.relpath(path_abs, root_abs))
+    separators = (os.sep,) if os.altsep is None else (os.sep, os.altsep)
+    if path_str.endswith(separators) and relative_path != "." and not relative_path.endswith("/"):
+        relative_path += "/"
+    return relative_path
+
+
 def assure_directory_exists(path: PathLike, is_file: bool = False) -> bool:
     """Make sure that the directory pointed to by path exists.
 

test/test_index.py

@@ -1086,14 +1086,43 @@ class Mocked:
         path = os.path.join(repo_root, f"directory2{os.sep}")
         index = IndexFile(repo)
 
-        expected_path = f"directory2{os.sep}"
+        expected_path = "directory2/"
         actual_path = index._to_relative_path(path)
         self.assertEqual(expected_path, actual_path)
 
-        with mock.patch("git.index.base.os.path") as ospath_mock:
-            ospath_mock.relpath.return_value = f"directory2{os.sep}"
-            actual_path = index._to_relative_path(path)
-            self.assertEqual(expected_path, actual_path)
+    @pytest.mark.skipif(sys.platform != "win32", reason="Specifically for Windows.")
+    @with_rw_directory
+    def test__to_relative_path_windows_path_kinds(self, rw_dir):
+        repo_root = osp.join(rw_dir, "repo")
+        os.makedirs(osp.join(repo_root, "nested"))
+
+        class Mocked:
+            bare = False
+            git_dir = osp.join(repo_root, ".git")
+            working_tree_dir = repo_root
+
+        index = IndexFile(Mocked())
+        inside_path = osp.join(repo_root, "nested", "file")
+        _drive, rooted_inside_path = osp.splitdrive(inside_path)
+
+        self.assertEqual(index._to_relative_path(inside_path), "nested/file")
+        self.assertEqual(index._to_relative_path(rooted_inside_path), "nested/file")
+        self.assertEqual(index._to_relative_path(rooted_inside_path.replace("\\", "/")), "nested/file")
+        self.assertEqual(index._to_relative_path(PathLikeMock(inside_path)), "nested/file")
+        self.assertEqual(index._to_relative_path(inside_path.upper()), "NESTED/FILE")
+        self.assertRaises(ValueError, index._to_relative_path, osp.join(repo_root + "-other", "file"))
+        self.assertRaises(ValueError, index._to_relative_path, osp.join("..", "outside"))
+        self.assertRaises(ValueError, index._to_relative_path, f"{osp.splitdrive(repo_root)[0]}relative")
+        self.assertRaises(ValueError, index._to_relative_path, R"Z:\outside")
+        self.assertRaises(ValueError, index._to_relative_path, R"\\server\share\outside")
+        self.assertRaises(ValueError, index._to_relative_path, R"\\?\C:\outside")
+
+        Mocked.bare = True
+        bare_index = IndexFile(Mocked())
+        self.assertRaises(InvalidGitRepositoryError, bare_index._to_relative_path, rooted_inside_path)
+        self.assertRaises(
+            InvalidGitRepositoryError, bare_index._to_relative_path, f"{osp.splitdrive(repo_root)[0]}relative"
+        )
 
     @pytest.mark.xfail(
         type(_win_bash_status) is WinBashStatus.Absent,