From fccfa12b91f7c17b81e9fe2dff8b90266ee95fcd Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 1 Aug 2026 16:34:57 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITICAL/H?=
 =?UTF-8?q?IGH]=20Fix=20local=20code=20execution=20via=20git=20in=20tests?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/unit/core/test_gitignore.py file invoked git via subprocess against the project root without disabling core.fsmonitor. This could allow local code execution via a malicious .git/config if a user ran tests in an untrusted cloned repository. We fix this by passing `_SAFE_GIT_CONFIG`.

Co-authored-by: tachyon-beep <544926+tachyon-beep@users.noreply.github.com>
---
 .jules/sentinel.md                | 5 +++++
 tests/unit/core/test_gitignore.py | 6 ++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index a48a87f5..5a44725c 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -7,3 +7,8 @@
 **Vulnerability:** The static analyzer was missing `yaml.unsafe_load` and `yaml.full_load` in its `_SERIALISATION_SINKS` mapping, potentially leading to false negatives when tracking untrusted data flowing into these dangerous deserialization functions.
 **Learning:** Even if functions are listed in rule specifications (like `_SINK_SPECS`), they also need to be properly categorized in the core taint propagation logic (`_SERIALISATION_SINKS`) to ensure the analyzer correctly sheds validation provenance (converting output to `UNKNOWN_RAW`).
 **Prevention:** When adding new sinks to rule definitions, always verify if they need to be added to core propagation mappings like `_SERIALISATION_SINKS` or `_PROPAGATING_BUILTINS`.
+
+## 2026-08-01 - Fix local code execution via git subprocess in tests
+**Vulnerability:** The `tests/unit/core/test_gitignore.py` file invoked `git` via `subprocess` against the project root without disabling `core.fsmonitor`. This could allow local code execution via a malicious `.git/config` if a user ran tests in an untrusted cloned repository.
+**Learning:** Even test files that run git commands against the repository root must apply safe git configurations, because developers might run tests on untrusted forks or PRs.
+**Prevention:** Always apply `("-c", "core.fsmonitor=false")` as `_SAFE_GIT_CONFIG` when invoking `git` via `subprocess` against any directory not strictly created and controlled by the test itself.
diff --git a/tests/unit/core/test_gitignore.py b/tests/unit/core/test_gitignore.py
index 1b2a94d5..60539a60 100644
--- a/tests/unit/core/test_gitignore.py
+++ b/tests/unit/core/test_gitignore.py
@@ -6,6 +6,8 @@
 
 from wardline.core.gitignore import GitignoreMatcher
 
+_SAFE_GIT_CONFIG = ("-c", "core.fsmonitor=false")
+
 
 def test_comments_and_blanks_ignored() -> None:
     m = GitignoreMatcher.from_text("# comment\n\n   \nnode_modules/\n")
@@ -113,7 +115,7 @@ def test_repo_gitignore_tracks_wardline_suppression_state() -> None:
         pytest.skip("git is required to validate repository ignore policy")
     repo = Path(__file__).resolve().parents[3]
     in_worktree = subprocess.run(
-        ["git", "-C", str(repo), "rev-parse", "--is-inside-work-tree"],
+        ["git", *_SAFE_GIT_CONFIG, "-C", str(repo), "rev-parse", "--is-inside-work-tree"],
         check=False,
         capture_output=True,
         text=True,
@@ -123,7 +125,7 @@ def test_repo_gitignore_tracks_wardline_suppression_state() -> None:
 
     def check_ignore(path: str) -> subprocess.CompletedProcess[str]:
         return subprocess.run(
-            ["git", "-C", str(repo), "check-ignore", "--no-index", "-v", path],
+            ["git", *_SAFE_GIT_CONFIG, "-C", str(repo), "check-ignore", "--no-index", "-v", path],
             check=False,
             capture_output=True,
             text=True,