tree e17ff1bace458e203800a7a35b98e840b0d6977c
parent 9cf85473209ea8ae2b56c13145c4704d12ee1374
author Johannes Schindelin <johannes.schindelin@gmx.de> 1711102762 +0100
committer Johannes Schindelin <johannes.schindelin@gmx.de> 1713385802 +0200

submodules: submodule paths must not contain symlinks

When creating a submodule path, we must be careful not to follow
symbolic links. Otherwise we may follow a symbolic link pointing to
a gitdir (which are valid symbolic links!) e.g. while cloning.

On case-insensitive filesystems, however, we blindly replace a directory
that has been created as part of the `clone` operation with a symlink
when the path to the latter differs only in case from the former's path.

Let's simply avoid this situation by expecting not ever having to
overwrite any existing file/directory/symlink upon cloning. That way, we
won't even replace a directory that we just created.

This addresses CVE-2024-32002.

Reported-by: Filip Hejsek <filip.hejsek@gmail.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>