Documentation
¶
Overview ¶
Package gitexec provides hardened git subprocess execution and credential scrubbing shared by the git and forges packages.
Index ¶
- Constants
- func Cmd(ctx context.Context, dir string, args ...string) *exec.Cmd
- func ParseRemoteHost(raw string) string
- func ParseSCPStyle(raw string) (host, path string, ok bool)
- func Run(ctx context.Context, dir string, args ...string) (string, error)
- func ScrubAuth(s string) string
- func ScrubAuthErr(err error) string
- type Timeouts
Constants ¶
const PlumbingTimeout = 5 * time.Second
PlumbingTimeout bounds a single local-only git plumbing command (e.g. remote get-url, symbolic-ref). 5 seconds is plenty for local-only operations on a healthy filesystem and tight enough that a wedged filesystem doesn't pin callers forever.
Variables ¶
This section is empty.
Functions ¶
func Cmd ¶
Cmd builds an *exec.Cmd for a git subprocess with hardening applied: protocol.ext.allow=never on the command line (so ext:: transports stay blocked even if user gitconfig tries to enable them — `-c` always wins over gitconfig), no terminal/askpass prompts (so credential failures bubble up as errors instead of hanging), and runtime GIT_CONFIG_* env injection cleared so a malicious parent process can't inject inline gitconfig.
IMPORTANT: this DOES allow the user's ~/.gitconfig and the system /etc/gitconfig to load. That's deliberate. The forge CLIs (gh auth setup-git, glab auth git-credential, etc.) write `credential.helper` lines into ~/.gitconfig so HTTPS clones of private repos can authenticate. A previous version of this function pinned GIT_CONFIG_GLOBAL=/dev/null which disabled the credential helper alongside the ext:: hardening — clones of public repos worked, but private clones failed with "terminal prompts disabled". The cmdline -c approach is a more surgical fix: it blocks ext:: explicitly without throwing out the rest of the user's git config.
The first non-flag arg in `args` must be one of allowedSubcommands; otherwise Cmd returns a command rigged to fail without launching git. This local guarantee satisfies CodeQL's go/command-injection analyzer and gives defence-in-depth against future callers that don't validate subcommand input upstream.
Callers must supply a context with an appropriate timeout.
func ParseRemoteHost ¶
ParseRemoteHost extracts the host segment from an https or scp-style git remote URL. Returns "" for unrecognised shapes.
https://github.com/foo/bar.git → github.com git@github.com:foo/bar.git → github.com ssh://git@gitlab.com/foo/bar.git → gitlab.com
Rejects ext:: remote-helper prefixes as a defense-in-depth measure.
func ParseSCPStyle ¶
ParseSCPStyle recognises git's scp-like remote syntax (user@host:path) and returns (host, path, true) on a successful match. Returns ok=false for anything else, including URLs with a :// scheme, strings without @, and ext:: remote-helper prefixes.
func ScrubAuth ¶
ScrubAuth strips credentials from a git subprocess output string. Idempotent: chained userinfo segments (`http://a@b@c@host`) are consumed until the match set stabilises. The regex strictly shrinks the string on every match (each iteration removes at least one `@segment`), so the loop is bounded by input length with no DoS risk.
func ScrubAuthErr ¶
ScrubAuthErr is a convenience wrapper for error values.
Types ¶
type Timeouts ¶
type Timeouts struct {
// Plumbing bounds local-only operations: branch, status, rev-parse.
Plumbing time.Duration
// Fetch bounds network read-only operations: fetch --quiet.
Fetch time.Duration
// Push bounds network write operations: push, pull.
Push time.Duration
// Clone bounds full-transfer operations from the UI git handler
// (shorter than the forges backend clone which allows 15m for
// pre-configured credential clones of large repos).
Clone time.Duration
}
Timeouts consolidates git subprocess timeout budgets into a single policy struct. Each consumer (git.Handler, forges.Registry) accepts a Timeouts value so the budget is explicit and testable.
func DefaultTimeouts ¶
func DefaultTimeouts() Timeouts
DefaultTimeouts returns the production timeout policy.
Source Files