@cyclonedx/cdxgen 12.1.5 → 12.2.1

package/lib/server/server.poku.js

@@ -1,4 +1,9 @@
+import os from "node:os";
+import path from "node:path";
+
+import esmock from "esmock";
 import { afterEach, assert, beforeEach, describe, it } from "poku";
+import sinon from "sinon";
 
 import { isWin } from "../helpers/utils.js";
 import {
@@ -11,53 +16,71 @@ import {
   validateAndRejectGitSource,
 } from "./server.js";
 
+function nullProtoObj(obj) {
+  if (obj === null || typeof obj !== "object") {
+    return obj;
+  }
+  if (Array.isArray(obj)) {
+    return obj.map(nullProtoObj);
+  }
+  if (Object.prototype.toString.call(obj) === "[object Object]") {
+    const result = Object.create(null);
+    for (const [key, value] of Object.entries(obj)) {
+      result[key] = nullProtoObj(value);
+    }
+    return result;
+  }
+  return obj;
+}
+
+function checkEqual(actual, expected, message) {
+  assert.deepStrictEqual(nullProtoObj(actual), nullProtoObj(expected), message);
+}
+
 it("parseValue tests", () => {
-  assert.deepStrictEqual(parseValue("foo"), "foo");
-  assert.deepStrictEqual(parseValue("foo\n"), "foo");
-  assert.deepStrictEqual(parseValue("foo\r\n"), "foo");
-  assert.deepStrictEqual(parseValue(1), 1);
-  assert.deepStrictEqual(parseValue("true"), true);
-  assert.deepStrictEqual(parseValue("false"), false);
-  assert.deepStrictEqual(parseValue(["foo", "bar", 42]), ["foo", "bar", 42]);
+  checkEqual(parseValue("foo"), "foo");
+  checkEqual(parseValue("foo\n"), "foo");
+  checkEqual(parseValue("foo\r\n"), "foo");
+  checkEqual(parseValue(1), 1);
+  checkEqual(parseValue("true"), true);
+  checkEqual(parseValue("false"), false);
+  checkEqual(parseValue(["foo", "bar", 42]), ["foo", "bar", 42]);
   assert.throws(() => parseValue({ foo: "bar" }), TypeError);
   assert.throws(() => parseValue([42, "foo", { foo: "bar" }]), TypeError);
   assert.throws(() => parseValue([42, "foo", new Error()]), TypeError);
   assert.throws(() => parseValue(["foo", "bar", new String(42)]), TypeError);
-  assert.deepStrictEqual(parseValue(true), true);
-  assert.deepStrictEqual(parseValue(false), false);
-  assert.deepStrictEqual(parseValue(null), null);
-  assert.deepStrictEqual(parseValue(undefined), undefined);
-  assert.deepStrictEqual(parseValue([null, undefined, null]), [
+  checkEqual(parseValue(true), true);
+  checkEqual(parseValue(false), false);
+  checkEqual(parseValue(null), null);
+  checkEqual(parseValue(undefined), undefined);
+  checkEqual(parseValue([null, undefined, null]), [null, undefined, null]);
+  checkEqual(parseValue(""), "");
+  checkEqual(parseValue("   \n"), "   ");
+  checkEqual(parseValue("42"), "42");
+  checkEqual(parseValue("0"), "0");
+  checkEqual(parseValue("-1"), "-1");
+  checkEqual(parseValue("True"), "True");
+  checkEqual(parseValue("False"), "False");
+  checkEqual(parseValue(" TRUE "), " TRUE ");
+  checkEqual(parseValue(["true", "false", 0, "0", null, undefined]), [
+    true,
+    false,
+    0,
+    "0",
     null,
     undefined,
-    null,
   ]);
-  assert.deepStrictEqual(parseValue(""), "");
-  assert.deepStrictEqual(parseValue("   \n"), "   ");
-  assert.deepStrictEqual(parseValue("42"), "42");
-  assert.deepStrictEqual(parseValue("0"), "0");
-  assert.deepStrictEqual(parseValue("-1"), "-1");
-  assert.deepStrictEqual(parseValue("True"), "True");
-  assert.deepStrictEqual(parseValue("False"), "False");
-  assert.deepStrictEqual(parseValue(" TRUE "), " TRUE ");
-  assert.deepStrictEqual(
-    parseValue(["true", "false", 0, "0", null, undefined]),
-    [true, false, 0, "0", null, undefined],
-  );
   assert.throws(() => parseValue([["nested"]]), TypeError);
   assert.throws(() => parseValue(Symbol("test")), TypeError);
   assert.throws(() => parseValue(BigInt(42)), TypeError);
   // biome-ignore-start lint/suspicious/noEmptyBlockStatements: test
   assert.throws(() => parseValue(() => {}), TypeError);
   // biome-ignore-end lint/suspicious/noEmptyBlockStatements: test
-  assert.deepStrictEqual(parseValue(Number.NaN), Number.NaN);
-  assert.deepStrictEqual(
-    parseValue(Number.POSITIVE_INFINITY),
-    Number.POSITIVE_INFINITY,
-  );
+  checkEqual(parseValue(Number.NaN), Number.NaN);
+  checkEqual(parseValue(Number.POSITIVE_INFINITY), Number.POSITIVE_INFINITY);
   const obj = { toString: () => "foo" };
   assert.throws(() => parseValue(obj), TypeError);
-  assert.deepStrictEqual(parseValue("hello\r\n"), "hello");
+  checkEqual(parseValue("hello\r\n"), "hello");
 });
 
 describe("parseQueryString tests", () => {
@@ -70,22 +93,42 @@ describe("parseQueryString tests", () => {
     };
     const options = {};
     const result = parseQueryString(q, body, options);
-    assert.deepStrictEqual(result.foo, undefined);
-    assert.deepStrictEqual(result.excludeType, ["2"]);
-    assert.deepStrictEqual(result.technique, ["manifest-analysis"]);
+    checkEqual(result.foo, undefined);
+    checkEqual(result.excludeType, ["2"]);
+    checkEqual(result.technique, ["manifest-analysis"]);
   });
 
   it("splits type into projectType and removes type", () => {
     const options = { type: "a,b,c" };
     const result = parseQueryString({}, {}, options);
-    assert.deepStrictEqual(result.projectType, ["a", "b", "c"]);
-    assert.deepStrictEqual(result.type, undefined);
+    checkEqual(result.projectType, ["a", "b", "c"]);
+    checkEqual(result.type, undefined);
   });
 
   it("sets installDeps to false for pre-build lifecycle", () => {
     const options = { lifecycle: "pre-build" };
     const result = parseQueryString({}, {}, options);
-    assert.deepStrictEqual(result.installDeps, false);
+    checkEqual(result.installDeps, false);
+  });
+
+  it("parses parentProjectName and parentProjectVersion", () => {
+    const q = {
+      parentProjectName: "parent-app",
+      parentProjectVersion: "1.2.3",
+    };
+    const result = parseQueryString(q, {}, {});
+    checkEqual(result.parentProjectName, "parent-app");
+    checkEqual(result.parentProjectVersion, "1.2.3");
+  });
+
+  it("parses autoCreate and isLatest boolean options", () => {
+    const q = {
+      autoCreate: "false",
+      isLatest: "true",
+    };
+    const result = parseQueryString(q, {}, {});
+    checkEqual(result.autoCreate, false);
+    checkEqual(result.isLatest, true);
   });
 });
 
@@ -102,23 +145,23 @@ describe("isAllowedHost()", () => {
 
   it("returns true if CDXGEN_SERVER_ALLOWED_HOSTS is not set", () => {
     delete process.env.CDXGEN_SERVER_ALLOWED_HOSTS;
-    assert.deepStrictEqual(isAllowedHost("anything"), true);
+    checkEqual(isAllowedHost("anything"), true);
   });
 
   it("returns true for a hostname that is in the list", () => {
     process.env.CDXGEN_SERVER_ALLOWED_HOSTS = "foo.com,bar.com";
-    assert.deepStrictEqual(isAllowedHost("foo.com"), true);
-    assert.deepStrictEqual(isAllowedHost("bar.com"), true);
+    checkEqual(isAllowedHost("foo.com"), true);
+    checkEqual(isAllowedHost("bar.com"), true);
   });
 
   it("returns false for a hostname not in the list", () => {
     process.env.CDXGEN_SERVER_ALLOWED_HOSTS = "foo.com,bar.com";
-    assert.deepStrictEqual(isAllowedHost("baz.com"), false);
+    checkEqual(isAllowedHost("baz.com"), false);
   });
 
   it("treats an empty-string env var as unset (returns true)", () => {
     process.env.CDXGEN_SERVER_ALLOWED_HOSTS = "";
-    assert.deepStrictEqual(isAllowedHost("whatever"), true);
+    checkEqual(isAllowedHost("whatever"), true);
   });
 });
 
@@ -203,15 +246,15 @@ describe("isAllowedPath()", () => {
 describe("isAllowedWinPath windows tests()", () => {
   it("returns false for windows device name paths", () => {
     if (isWin) {
-      assert.deepStrictEqual(isAllowedWinPath("CON:../foo"), false);
-      assert.deepStrictEqual(isAllowedWinPath("X:\\foo\\..\\bar"), true);
-      assert.deepStrictEqual(isAllowedWinPath("C:\\Users"), true);
-      assert.deepStrictEqual(isAllowedWinPath("C:\\🚀"), true);
-      assert.deepStrictEqual(isAllowedWinPath("C:"), true);
-      assert.deepStrictEqual(isAllowedWinPath("c:"), true);
-      assert.deepStrictEqual(isAllowedWinPath("CON:"), false);
-      assert.deepStrictEqual(isAllowedWinPath("COM¹:"), false);
-      assert.deepStrictEqual(isAllowedWinPath("COM¹:../foo"), false);
+      checkEqual(isAllowedWinPath("CON:../foo"), false);
+      checkEqual(isAllowedWinPath("X:\\foo\\..\\bar"), true);
+      checkEqual(isAllowedWinPath("C:\\Users"), true);
+      checkEqual(isAllowedWinPath("C:\\🚀"), true);
+      checkEqual(isAllowedWinPath("C:"), true);
+      checkEqual(isAllowedWinPath("c:"), true);
+      checkEqual(isAllowedWinPath("CON:"), false);
+      checkEqual(isAllowedWinPath("COM¹:"), false);
+      checkEqual(isAllowedWinPath("COM¹:../foo"), false);
       for (const d of [
         "PRN:.\\..\\bar",
         "LpT5:/another/path",
@@ -244,7 +287,7 @@ describe("isAllowedWinPath windows tests()", () => {
         "🚀:\\",
         "⚡:\\",
       ]) {
-        assert.deepStrictEqual(isAllowedWinPath(d), false);
+        checkEqual(isAllowedWinPath(d), false);
       }
     }
   });
@@ -264,7 +307,7 @@ describe("getQueryParams", () => {
     );
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       url: "https://example.com",
       multiProject: "true",
       type: "js",
@@ -277,7 +320,7 @@ describe("getQueryParams", () => {
     );
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       q: "hello world",
       filter: "category=tech",
     });
@@ -288,7 +331,7 @@ describe("getQueryParams", () => {
     const result = getQueryParams(req);
 
     // URLSearchParams.entries() returns the first value when there are duplicates
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       tags: ["javascript", "react", "node"],
     });
   });
@@ -297,21 +340,21 @@ describe("getQueryParams", () => {
     const req = createMockRequest("/sbom");
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {});
+    checkEqual(result, {});
   });
 
   it("should handle query string with only question mark", () => {
     const req = createMockRequest("/sbom?");
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {});
+    checkEqual(result, {});
   });
 
   it("should handle parameters without values", () => {
     const req = createMockRequest("/api?flag1&flag2&param=value");
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       flag1: "",
       flag2: "",
       param: "value",
@@ -325,7 +368,7 @@ describe("getQueryParams", () => {
     );
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       param1: "value1",
     });
   });
@@ -338,7 +381,7 @@ describe("getQueryParams", () => {
     );
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       token: "abc123",
     });
   });
@@ -349,7 +392,7 @@ describe("getQueryParams", () => {
     );
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       name: "john",
       age: "25",
       active: "true",
@@ -362,7 +405,7 @@ describe("getQueryParams", () => {
     );
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       q: "hello world!",
       category: "web development",
     });
@@ -372,14 +415,14 @@ describe("getQueryParams", () => {
     const req = createMockRequest(undefined);
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {});
+    checkEqual(result, {});
   });
 
   it("should handle numeric values as strings", () => {
     const req = createMockRequest("/calculate?x=10&y=20&operation=add");
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       x: "10",
       y: "20",
       operation: "add",
@@ -390,7 +433,7 @@ describe("getQueryParams", () => {
     const req = createMockRequest("/config?debug=true&verbose=false&enabled=1");
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       debug: "true",
       verbose: "false",
       enabled: "1",
@@ -402,7 +445,7 @@ describe("getQueryParams", () => {
     const req = createMockRequest("not-a-valid-url");
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {});
+    checkEqual(result, {});
   });
 
   it("should handle empty host gracefully", () => {
@@ -413,7 +456,7 @@ describe("getQueryParams", () => {
     };
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       param: "value",
     });
   });
@@ -426,7 +469,7 @@ describe("getQueryParams", () => {
     };
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       param: "value",
     });
   });
@@ -450,84 +493,60 @@ describe("validateGitSource() tests", () => {
   });
 
   it("should reject ext:: and fd:: outright", () => {
-    assert.deepStrictEqual(
+    checkEqual(
       validateAndRejectGitSource("ext::sh -c id").error,
       "Invalid Protocol",
     );
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("fd::123").error,
-      "Invalid Protocol",
-    );
-    assert.deepStrictEqual(
+    checkEqual(validateAndRejectGitSource("fd::123").error, "Invalid Protocol");
+    checkEqual(
       validateAndRejectGitSource("EXT::sh -c id").error,
       "Invalid Protocol",
     );
   });
 
   it("should allow standard local paths to bypass validation", () => {
-    assert.deepStrictEqual(validateAndRejectGitSource("/tmp/local-path"), null);
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("C:\\Users\\local"),
-      null,
-    );
+    checkEqual(validateAndRejectGitSource("/tmp/local-path"), null);
+    checkEqual(validateAndRejectGitSource("C:\\Users\\local"), null);
   });
 
   it("should handle ssh git@ format gracefully", () => {
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("git@github.com:foo/bar.git"),
-      null,
-    );
+    checkEqual(validateAndRejectGitSource("git@github.com:foo/bar.git"), null);
   });
 
   it("should reject malformed git URLs", () => {
     // invalid URL format (can't parse via node's new URL object)
-    assert.deepStrictEqual(
+    checkEqual(
       validateAndRejectGitSource("http://[:::1]/bad-ipv6").error,
       "Invalid URL Format",
     );
   });
 
   it("should enforce GIT_ALLOW_PROTOCOL default schemes", () => {
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("https://github.com/repo"),
-      null,
-    );
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("http://github.com/repo"),
-      {
-        status: 400,
-        error: "Protocol Not Allowed",
-        details: "The protocol 'http:' is not permitted by GIT_ALLOW_PROTOCOL.",
-      },
-    );
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("git://github.com/repo"),
-      null,
-    );
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("ssh://github.com/repo"),
-      null,
-    );
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("git+ssh://github.com/repo"),
-      null,
-    );
+    checkEqual(validateAndRejectGitSource("https://github.com/repo"), null);
+    checkEqual(validateAndRejectGitSource("http://github.com/repo"), {
+      status: 400,
+      error: "Protocol Not Allowed",
+      details: "The protocol 'http:' is not permitted by GIT_ALLOW_PROTOCOL.",
+    });
+    checkEqual(validateAndRejectGitSource("git://github.com/repo"), null);
+    checkEqual(validateAndRejectGitSource("ssh://github.com/repo"), null);
+    checkEqual(validateAndRejectGitSource("git+ssh://github.com/repo"), null);
 
     // ftp is not allowed by default
     const res = validateAndRejectGitSource("ftp://github.com/repo");
-    assert.deepStrictEqual(res.error, "Protocol Not Allowed");
-    assert.deepStrictEqual(
+    checkEqual(res.error, "Protocol Not Allowed");
+    checkEqual(
       res.details,
       "The protocol 'ftp:' is not permitted by GIT_ALLOW_PROTOCOL.",
     );
   });
 
   it("should reject protocol smuggling techniques", () => {
-    assert.deepStrictEqual(
+    checkEqual(
       validateAndRejectGitSource("git+ext://github.com/repo").error,
       "Protocol Not Allowed",
     );
-    assert.deepStrictEqual(
+    checkEqual(
       validateAndRejectGitSource("http+ext://github.com/repo").error,
       "Protocol Not Allowed",
     );
@@ -535,30 +554,24 @@ describe("validateGitSource() tests", () => {
 
   it("should respect custom CDXGEN_SERVER_GIT_ALLOW_PROTOCOL configs", () => {
     process.env.CDXGEN_SERVER_GIT_ALLOW_PROTOCOL = "https:git";
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("https://github.com/repo"),
-      null,
-    );
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("git://github.com/repo"),
-      null,
-    );
+    checkEqual(validateAndRejectGitSource("https://github.com/repo"), null);
+    checkEqual(validateAndRejectGitSource("git://github.com/repo"), null);
 
     // http is no longer allowed
     const res = validateAndRejectGitSource("http://github.com/repo");
-    assert.deepStrictEqual(res.error, "Protocol Not Allowed");
-    assert.deepStrictEqual(
+    checkEqual(res.error, "Protocol Not Allowed");
+    checkEqual(
       res.details,
       "The protocol 'http:' is not permitted by GIT_ALLOW_PROTOCOL.",
     );
   });
 
   it("should reject remote helper syntax (::) inside valid schemes", () => {
-    assert.deepStrictEqual(
+    checkEqual(
       validateAndRejectGitSource("https://github.com/ext::sh -c id").error,
       "Invalid URL Syntax",
     );
-    assert.deepStrictEqual(
+    checkEqual(
       validateAndRejectGitSource("git://foo::bar/repo").error,
       "Invalid URL Format",
     );
@@ -566,44 +579,219 @@ describe("validateGitSource() tests", () => {
 
   it("should validate allowed hosts", () => {
     process.env.CDXGEN_SERVER_ALLOWED_HOSTS = "github.com,gitlab.com";
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("https://github.com/repo"),
-      null,
-    );
+    checkEqual(validateAndRejectGitSource("https://github.com/repo"), null);
 
     const res = validateAndRejectGitSource("https://evil.com/repo");
-    assert.deepStrictEqual(res.error, "Host Not Allowed");
-    assert.deepStrictEqual(res.status, 403);
+    checkEqual(res.error, "Host Not Allowed");
+    checkEqual(res.status, 403);
   });
 });
 it("should correctly normalize and validate various git@ (SCP-like) formats", () => {
-  assert.deepStrictEqual(
+  checkEqual(
     validateAndRejectGitSource("git@gitlab.com:group/project.git"),
     null,
   );
-  assert.deepStrictEqual(
+  checkEqual(
     validateAndRejectGitSource("git@bitbucket.org:workspace/repo:name.git"),
     null,
   );
-  assert.deepStrictEqual(
-    validateAndRejectGitSource("git@github.com/user/repo.git"),
-    null,
-  );
-  assert.deepStrictEqual(
+  checkEqual(validateAndRejectGitSource("git@github.com/user/repo.git"), null);
+  checkEqual(
     validateAndRejectGitSource("ssh://git@github.com/user/repo.git"),
     null,
   );
   process.env.CDXGEN_SERVER_ALLOWED_HOSTS = "github.com,bitbucket.org";
-  assert.deepStrictEqual(
-    validateAndRejectGitSource("git@github.com:user/repo.git"),
-    null,
-  );
-  assert.deepStrictEqual(
+  checkEqual(validateAndRejectGitSource("git@github.com:user/repo.git"), null);
+  checkEqual(
     validateAndRejectGitSource("git@bitbucket.org:workspace/repo.git"),
     null,
   );
   const deniedRes = validateAndRejectGitSource("git@evil.com:foo/bar.git");
-  assert.deepStrictEqual(deniedRes.status, 403);
-  assert.deepStrictEqual(deniedRes.error, "Host Not Allowed");
+  checkEqual(deniedRes.status, 403);
+  checkEqual(deniedRes.error, "Host Not Allowed");
   delete process.env.CDXGEN_SERVER_ALLOWED_HOSTS;
 });
+
+describe("gitClone() hardening tests", () => {
+  it("passes core.hooksPath=/dev/null and --template= flags to git", async () => {
+    const spawnStub = sinon.stub().returns({ status: 0, stderr: "" });
+    const mkdtempStub = sinon
+      .stub()
+      .returns(path.join(os.tmpdir(), "fake-repo"));
+
+    const { gitClone } = await esmock("./server.js", {
+      "../helpers/utils.js": {
+        safeSpawnSync: spawnStub,
+        isSecureMode: false,
+        hasDangerousUnicode: sinon.stub().returns(false),
+        getTmpDir: sinon.stub().returns(os.tmpdir()),
+      },
+      "node:fs": {
+        mkdtempSync: mkdtempStub,
+        existsSync: sinon.stub().returns(false),
+        readdirSync: sinon.stub().returns([]),
+        statSync: sinon.stub().returns({ isDirectory: () => true }),
+        readFileSync: sinon.stub().returns(""),
+      },
+    });
+
+    gitClone("https://example.com/repo.git");
+
+    sinon.assert.calledOnce(spawnStub);
+    const [cmd, args] = spawnStub.firstCall.args;
+    assert.strictEqual(cmd, "git");
+
+    // core.hooksPath=/dev/null must be present as a -c flag
+    const hooksPathIdx = args.indexOf("core.hooksPath=/dev/null");
+    assert.ok(
+      hooksPathIdx > 0 && args[hooksPathIdx - 1] === "-c",
+      "expected -c core.hooksPath=/dev/null in git args",
+    );
+
+    // --template= must appear after "clone"
+    const cloneIdx = args.indexOf("clone");
+    assert.ok(cloneIdx >= 0, "expected 'clone' subcommand in git args");
+    assert.ok(
+      args.slice(cloneIdx).includes("--template="),
+      "expected --template= after clone in git args",
+    );
+  });
+
+  it("uses GIT_CONFIG_GLOBAL=/dev/null instead of invalid GIT_CONFIG_NOGLOBAL in secure mode", async () => {
+    const spawnStub = sinon.stub().returns({ status: 0, stderr: "" });
+    const mkdtempStub = sinon
+      .stub()
+      .returns(path.join(os.tmpdir(), "fake-repo"));
+
+    const { gitClone } = await esmock("./server.js", {
+      "../helpers/utils.js": {
+        safeSpawnSync: spawnStub,
+        isSecureMode: true,
+        hasDangerousUnicode: sinon.stub().returns(false),
+        getTmpDir: sinon.stub().returns(os.tmpdir()),
+      },
+      "node:fs": {
+        mkdtempSync: mkdtempStub,
+        existsSync: sinon.stub().returns(false),
+        readdirSync: sinon.stub().returns([]),
+        statSync: sinon.stub().returns({ isDirectory: () => true }),
+        readFileSync: sinon.stub().returns(""),
+      },
+    });
+
+    gitClone("https://example.com/repo.git");
+
+    sinon.assert.calledOnce(spawnStub);
+    const opts = spawnStub.firstCall.args[2];
+    assert.ok(opts.env, "expected env to be set");
+    assert.ok(
+      !("GIT_CONFIG_NOGLOBAL" in opts.env),
+      "GIT_CONFIG_NOGLOBAL must not be set (it is not a valid Git env var)",
+    );
+    assert.strictEqual(
+      opts.env.GIT_CONFIG_GLOBAL,
+      "/dev/null",
+      "GIT_CONFIG_GLOBAL must be /dev/null in secure mode",
+    );
+    assert.strictEqual(
+      opts.env.GIT_CONFIG_NOSYSTEM,
+      "1",
+      "GIT_CONFIG_NOSYSTEM must be '1' in secure mode",
+    );
+  });
+
+  it("sets GIT_TERMINAL_PROMPT=0 in both secure and non-secure mode", async () => {
+    for (const secureMode of [false, true]) {
+      const spawnStub = sinon.stub().returns({ status: 0, stderr: "" });
+      const mkdtempStub = sinon
+        .stub()
+        .returns(path.join(os.tmpdir(), "fake-repo"));
+
+      const { gitClone } = await esmock("./server.js", {
+        "../helpers/utils.js": {
+          safeSpawnSync: spawnStub,
+          isSecureMode: secureMode,
+          hasDangerousUnicode: sinon.stub().returns(false),
+          getTmpDir: sinon.stub().returns(os.tmpdir()),
+        },
+        "node:fs": {
+          mkdtempSync: mkdtempStub,
+          existsSync: sinon.stub().returns(false),
+          readdirSync: sinon.stub().returns([]),
+          statSync: sinon.stub().returns({ isDirectory: () => true }),
+          readFileSync: sinon.stub().returns(""),
+        },
+      });
+
+      gitClone("https://example.com/repo.git");
+
+      const opts = spawnStub.firstCall.args[2];
+      assert.strictEqual(
+        opts.env.GIT_TERMINAL_PROMPT,
+        "0",
+        `GIT_TERMINAL_PROMPT must be '0' when isSecureMode=${secureMode}`,
+      );
+    }
+  });
+
+  it("inserts --branch before repoUrl when a valid branch is specified", async () => {
+    const spawnStub = sinon.stub().returns({ status: 0, stderr: "" });
+    const mkdtempStub = sinon
+      .stub()
+      .returns(path.join(os.tmpdir(), "fake-repo"));
+
+    const { gitClone } = await esmock("./server.js", {
+      "../helpers/utils.js": {
+        safeSpawnSync: spawnStub,
+        isSecureMode: false,
+        hasDangerousUnicode: sinon.stub().returns(false),
+        getTmpDir: sinon.stub().returns(os.tmpdir()),
+      },
+      "node:fs": {
+        mkdtempSync: mkdtempStub,
+        existsSync: sinon.stub().returns(false),
+        readdirSync: sinon.stub().returns([]),
+        statSync: sinon.stub().returns({ isDirectory: () => true }),
+        readFileSync: sinon.stub().returns(""),
+      },
+    });
+
+    gitClone("https://example.com/repo.git", "main");
+
+    const [, args] = spawnStub.firstCall.args;
+    const branchIdx = args.indexOf("--branch");
+    assert.ok(branchIdx >= 0, "expected --branch in git args");
+    assert.strictEqual(args[branchIdx + 1], "main");
+  });
+
+  it("skips --branch when the branch name starts with a dash", async () => {
+    const spawnStub = sinon.stub().returns({ status: 0, stderr: "" });
+    const mkdtempStub = sinon
+      .stub()
+      .returns(path.join(os.tmpdir(), "fake-repo"));
+
+    const { gitClone } = await esmock("./server.js", {
+      "../helpers/utils.js": {
+        safeSpawnSync: spawnStub,
+        isSecureMode: false,
+        hasDangerousUnicode: sinon.stub().returns(false),
+        getTmpDir: sinon.stub().returns(os.tmpdir()),
+      },
+      "node:fs": {
+        mkdtempSync: mkdtempStub,
+        existsSync: sinon.stub().returns(false),
+        readdirSync: sinon.stub().returns([]),
+        statSync: sinon.stub().returns({ isDirectory: () => true }),
+        readFileSync: sinon.stub().returns(""),
+      },
+    });
+
+    gitClone("https://example.com/repo.git", "--malicious");
+
+    const [, args] = spawnStub.firstCall.args;
+    assert.ok(
+      !args.includes("--branch"),
+      "must not include --branch for dash-prefixed branch names",
+    );
+  });
+});