isomorphic-git 1.38.4 → 1.38.6

package/managers/index.cjs

@@ -698,6 +698,18 @@ function dirname(path) {
  * This code for `path.join` is directly copied from @zenfs/core/path for bundle size improvements.
  * SPDX-License-Identifier: LGPL-3.0-or-later
  * Copyright (c) James Prevett and other ZenFS contributors.
+ *
+ * Windows support added:
+ *   - Backslashes are normalised to forward slashes before processing.
+ *   - Drive-letter prefixes (e.g. "C:") are detected and preserved through
+ *     normalisation, so absolute Windows paths are handled correctly.
+ *   - An absolute argument passed to join() resets the accumulated path,
+ *     matching Node behaviour and handling worktree gitdir paths properly.
+ *
+ * Limitation: UNC paths (e.g. \\server\share) are not supported. The leading
+ *   backslashes are normalised to forward slashes and then collapsed by
+ *   normalizeString, losing the UNC root. Git on Windows works with
+ *   drive-letter paths, so this is not expected to be a practical issue.
  */
 
 function normalizeString(path, aar) {
@@ -761,29 +773,67 @@ function normalizeString(path, aar) {
   return res
 }
 
+// Returns the Windows drive prefix ("C:") if present, otherwise null.
+function getWindowsDrivePrefix(path) {
+  if (path.length >= 2 && /^[a-zA-Z]:/.test(path)) {
+    return path.slice(0, 2) // e.g. "C:"
+  }
+  return null
+}
+
 function normalize(path) {
   if (!path.length) return '.'
 
-  const isAbsolute = path[0] === '/';
+  // Normalise backslashes to forward slashes before any other processing.
+  path = path.replace(/\\/g, '/');
+
+  const drivePrefix = getWindowsDrivePrefix(path);
+  // isAbsolute: Unix root ('/foo') OR Windows drive+slash ('C:/foo').
+  const isAbsolute =
+    path[0] === '/' || (drivePrefix !== null && path[2] === '/');
   const trailingSeparator = path.at(-1) === '/';
 
-  path = normalizeString(path, !isAbsolute);
+  // Strip the drive prefix before feeding into normalizeString so that the
+  // core algorithm only ever sees a plain POSIX-style string.
+  const pathBody = drivePrefix ? path.slice(2) : path;
+
+  let normalized = normalizeString(pathBody, !isAbsolute);
 
-  if (!path.length) {
-    if (isAbsolute) return '/'
-    return trailingSeparator ? './' : '.'
+  if (!normalized.length) {
+    const root = drivePrefix
+      ? isAbsolute
+        ? drivePrefix + '/'
+        : drivePrefix
+      : isAbsolute
+        ? '/'
+        : '.';
+    return trailingSeparator && !isAbsolute ? root + '/' : root
   }
-  if (trailingSeparator) path += '/';
+  if (trailingSeparator) normalized += '/';
 
-  return isAbsolute ? `/${path}` : path
+  if (drivePrefix) {
+    return isAbsolute
+      ? `${drivePrefix}/${normalized}`
+      : `${drivePrefix}${normalized}`
+  }
+  return isAbsolute ? `/${normalized}` : normalized
 }
 
 function join(...args) {
   if (args.length === 0) return '.'
   let joined;
   for (let i = 0; i < args.length; ++i) {
-    const arg = args[i];
-    if (arg.length > 0) {
+    // Normalise separators before processing.
+    const arg = args[i].replace(/\\/g, '/');
+    if (arg.length === 0) continue
+
+    // A Windows drive-letter path (e.g. "C:/worktrees/foo") cannot be
+    // meaningfully appended to any base, so it resets the accumulator.
+    // Unix absolute paths (leading '/') are NOT reset here — that would be
+    // path.resolve() semantics; path.join('foo', '/bar') must yield 'foo/bar'.
+    if (/^[a-zA-Z]:\//.test(arg)) {
+      joined = arg;
+    } else {
       if (joined === undefined) joined = arg;
       else joined += '/' + arg;
     }
@@ -2024,7 +2074,13 @@ class GitRefManager {
    * @param {number} [args.depth = undefined] - The maximum depth to resolve symbolic refs.
    * @returns {Promise<string>} - The resolved object ID.
    */
-  static async resolve({ fs, gitdir, ref, depth = undefined }) {
+  static async resolve({
+    fs,
+    gitdir,
+    ref,
+    depth = undefined,
+    visited = new Set(),
+  }) {
     if (depth !== undefined) {
       depth--;
       if (depth === -1) {
@@ -2035,7 +2091,7 @@ class GitRefManager {
     // Is it a ref pointer?
     if (ref.startsWith('ref: ')) {
       ref = ref.slice('ref: '.length);
-      return GitRefManager.resolve({ fs, gitdir, ref, depth })
+      return GitRefManager.resolve({ fs, gitdir, ref, depth, visited })
     }
     // Is it a complete and valid SHA?
     if (ref.length === 40 && /[0-9a-f]{40}/.test(ref)) {
@@ -2054,7 +2110,21 @@ class GitRefManager {
           packedMap.get(ref)
       );
       if (sha) {
-        return GitRefManager.resolve({ fs, gitdir, ref: sha.trim(), depth })
+        // Guard against circular symbolic references (e.g. a -> b -> a). Without
+        // tracking visited refs this recursion would not terminate.
+        if (visited.has(ref)) {
+          throw new InternalError(
+            `Circular reference detected while resolving ref "${ref}"`
+          )
+        }
+        visited.add(ref);
+        return GitRefManager.resolve({
+          fs,
+          gitdir,
+          ref: sha.trim(),
+          depth,
+          visited,
+        })
       }
     }
     // Do we give up?
@@ -3569,21 +3639,26 @@ function applyDelta(delta, source) {
   if (firstOp.byteLength === targetSize) {
     target = firstOp;
   } else {
-    // Otherwise, allocate a fresh buffer and slices
-    target = Buffer.alloc(targetSize);
-    const writer = new BufferCursor(target);
-    writer.copy(firstOp);
+    // Build the result from the delta ops instead of pre-allocating `targetSize`.
+    // `targetSize` comes from the delta header and may not match the actual op output,
+    // so allocating it up front can reserve far more memory than the ops produce.
+    // Building from the ops bounds memory to the real output size; the size check below
+    // still validates the total before concatenating.
+    const chunks = [firstOp];
+    let tell = firstOp.byteLength;
 
     while (!reader.eof()) {
-      writer.copy(readOp(reader, source));
+      const op = readOp(reader, source);
+      chunks.push(op);
+      tell += op.byteLength;
     }
 
-    const tell = writer.tell();
     if (targetSize !== tell) {
       throw new InternalError(
         `applyDelta expected target buffer to be ${targetSize} bytes but the resulting buffer was ${tell} bytes`
       )
     }
+    target = Buffer.concat(chunks, targetSize);
   }
   return target
 }
@@ -4840,8 +4915,25 @@ function parseBuffer(buffer) {
     const type = mode2type$1(mode);
     const path = buffer.slice(space + 1, nullchar).toString('utf8');
 
-    // Prevent malicious git repos from writing to "..\foo" on clone etc
-    if (path.includes('\\') || path.includes('/')) {
+    // Reject reserved entry names, matching git's verify_path(): path separators,
+    // "." and ".." (which resolve outside the working directory), and ".git" (which git
+    // disallows as a path component). Checks mirror git's is_ntfs_dotgit() and
+    // is_hfs_dotgit(): case-insensitive, trailing dots/spaces stripped (NTFS),
+    // NTFS 8.3 short name aliases (git~1..git~9), and HFS+ ignorable Unicode
+    // characters stripped (zero-width joiners, directional marks, BOM, etc.).
+    const hfsClean = path.replace(
+      /[\u200C-\u200F\u202A-\u202E\u206A-\u206F\uFEFF]/g,
+      ''
+    );
+    const normalized = hfsClean.toLowerCase().replace(/[. ]+$/, '');
+    if (
+      path.includes('\\') ||
+      path.includes('/') ||
+      hfsClean === '.' ||
+      hfsClean === '..' ||
+      normalized === '.git' ||
+      /^\.?git~[1-9]$/.test(normalized)
+    ) {
       throw new UnsafeFilepathError(path)
     }
 

package/managers/index.d.cts

@@ -568,7 +568,7 @@ export class GitRefManager {
      * @param {number} [args.depth = undefined] - The maximum depth to resolve symbolic refs.
      * @returns {Promise<string>} - The resolved object ID.
      */
-    static resolve({ fs, gitdir, ref, depth }: {
+    static resolve({ fs, gitdir, ref, depth, visited, }: {
         fs: FSClient;
         gitdir?: string | undefined;
         ref: string;

package/managers/index.d.ts

@@ -567,7 +567,7 @@ export class GitRefManager {
      * @param {number} [args.depth = undefined] - The maximum depth to resolve symbolic refs.
      * @returns {Promise<string>} - The resolved object ID.
      */
-    static resolve({ fs, gitdir, ref, depth }: {
+    static resolve({ fs, gitdir, ref, depth, visited, }: {
         fs: FSClient;
         gitdir?: string | undefined;
         ref: string;

package/managers/index.js

@@ -691,6 +691,18 @@ function dirname(path) {
  * This code for `path.join` is directly copied from @zenfs/core/path for bundle size improvements.
  * SPDX-License-Identifier: LGPL-3.0-or-later
  * Copyright (c) James Prevett and other ZenFS contributors.
+ *
+ * Windows support added:
+ *   - Backslashes are normalised to forward slashes before processing.
+ *   - Drive-letter prefixes (e.g. "C:") are detected and preserved through
+ *     normalisation, so absolute Windows paths are handled correctly.
+ *   - An absolute argument passed to join() resets the accumulated path,
+ *     matching Node behaviour and handling worktree gitdir paths properly.
+ *
+ * Limitation: UNC paths (e.g. \\server\share) are not supported. The leading
+ *   backslashes are normalised to forward slashes and then collapsed by
+ *   normalizeString, losing the UNC root. Git on Windows works with
+ *   drive-letter paths, so this is not expected to be a practical issue.
  */
 
 function normalizeString(path, aar) {
@@ -754,29 +766,67 @@ function normalizeString(path, aar) {
   return res
 }
 
+// Returns the Windows drive prefix ("C:") if present, otherwise null.
+function getWindowsDrivePrefix(path) {
+  if (path.length >= 2 && /^[a-zA-Z]:/.test(path)) {
+    return path.slice(0, 2) // e.g. "C:"
+  }
+  return null
+}
+
 function normalize(path) {
   if (!path.length) return '.'
 
-  const isAbsolute = path[0] === '/';
+  // Normalise backslashes to forward slashes before any other processing.
+  path = path.replace(/\\/g, '/');
+
+  const drivePrefix = getWindowsDrivePrefix(path);
+  // isAbsolute: Unix root ('/foo') OR Windows drive+slash ('C:/foo').
+  const isAbsolute =
+    path[0] === '/' || (drivePrefix !== null && path[2] === '/');
   const trailingSeparator = path.at(-1) === '/';
 
-  path = normalizeString(path, !isAbsolute);
+  // Strip the drive prefix before feeding into normalizeString so that the
+  // core algorithm only ever sees a plain POSIX-style string.
+  const pathBody = drivePrefix ? path.slice(2) : path;
+
+  let normalized = normalizeString(pathBody, !isAbsolute);
 
-  if (!path.length) {
-    if (isAbsolute) return '/'
-    return trailingSeparator ? './' : '.'
+  if (!normalized.length) {
+    const root = drivePrefix
+      ? isAbsolute
+        ? drivePrefix + '/'
+        : drivePrefix
+      : isAbsolute
+        ? '/'
+        : '.';
+    return trailingSeparator && !isAbsolute ? root + '/' : root
   }
-  if (trailingSeparator) path += '/';
+  if (trailingSeparator) normalized += '/';
 
-  return isAbsolute ? `/${path}` : path
+  if (drivePrefix) {
+    return isAbsolute
+      ? `${drivePrefix}/${normalized}`
+      : `${drivePrefix}${normalized}`
+  }
+  return isAbsolute ? `/${normalized}` : normalized
 }
 
 function join(...args) {
   if (args.length === 0) return '.'
   let joined;
   for (let i = 0; i < args.length; ++i) {
-    const arg = args[i];
-    if (arg.length > 0) {
+    // Normalise separators before processing.
+    const arg = args[i].replace(/\\/g, '/');
+    if (arg.length === 0) continue
+
+    // A Windows drive-letter path (e.g. "C:/worktrees/foo") cannot be
+    // meaningfully appended to any base, so it resets the accumulator.
+    // Unix absolute paths (leading '/') are NOT reset here — that would be
+    // path.resolve() semantics; path.join('foo', '/bar') must yield 'foo/bar'.
+    if (/^[a-zA-Z]:\//.test(arg)) {
+      joined = arg;
+    } else {
       if (joined === undefined) joined = arg;
       else joined += '/' + arg;
     }
@@ -2017,7 +2067,13 @@ class GitRefManager {
    * @param {number} [args.depth = undefined] - The maximum depth to resolve symbolic refs.
    * @returns {Promise<string>} - The resolved object ID.
    */
-  static async resolve({ fs, gitdir, ref, depth = undefined }) {
+  static async resolve({
+    fs,
+    gitdir,
+    ref,
+    depth = undefined,
+    visited = new Set(),
+  }) {
     if (depth !== undefined) {
       depth--;
       if (depth === -1) {
@@ -2028,7 +2084,7 @@ class GitRefManager {
     // Is it a ref pointer?
     if (ref.startsWith('ref: ')) {
       ref = ref.slice('ref: '.length);
-      return GitRefManager.resolve({ fs, gitdir, ref, depth })
+      return GitRefManager.resolve({ fs, gitdir, ref, depth, visited })
     }
     // Is it a complete and valid SHA?
     if (ref.length === 40 && /[0-9a-f]{40}/.test(ref)) {
@@ -2047,7 +2103,21 @@ class GitRefManager {
           packedMap.get(ref)
       );
       if (sha) {
-        return GitRefManager.resolve({ fs, gitdir, ref: sha.trim(), depth })
+        // Guard against circular symbolic references (e.g. a -> b -> a). Without
+        // tracking visited refs this recursion would not terminate.
+        if (visited.has(ref)) {
+          throw new InternalError(
+            `Circular reference detected while resolving ref "${ref}"`
+          )
+        }
+        visited.add(ref);
+        return GitRefManager.resolve({
+          fs,
+          gitdir,
+          ref: sha.trim(),
+          depth,
+          visited,
+        })
       }
     }
     // Do we give up?
@@ -3562,21 +3632,26 @@ function applyDelta(delta, source) {
   if (firstOp.byteLength === targetSize) {
     target = firstOp;
   } else {
-    // Otherwise, allocate a fresh buffer and slices
-    target = Buffer.alloc(targetSize);
-    const writer = new BufferCursor(target);
-    writer.copy(firstOp);
+    // Build the result from the delta ops instead of pre-allocating `targetSize`.
+    // `targetSize` comes from the delta header and may not match the actual op output,
+    // so allocating it up front can reserve far more memory than the ops produce.
+    // Building from the ops bounds memory to the real output size; the size check below
+    // still validates the total before concatenating.
+    const chunks = [firstOp];
+    let tell = firstOp.byteLength;
 
     while (!reader.eof()) {
-      writer.copy(readOp(reader, source));
+      const op = readOp(reader, source);
+      chunks.push(op);
+      tell += op.byteLength;
     }
 
-    const tell = writer.tell();
     if (targetSize !== tell) {
       throw new InternalError(
         `applyDelta expected target buffer to be ${targetSize} bytes but the resulting buffer was ${tell} bytes`
       )
     }
+    target = Buffer.concat(chunks, targetSize);
   }
   return target
 }
@@ -4827,8 +4902,25 @@ function parseBuffer(buffer) {
     const type = mode2type$1(mode);
     const path = buffer.slice(space + 1, nullchar).toString('utf8');
 
-    // Prevent malicious git repos from writing to "..\foo" on clone etc
-    if (path.includes('\\') || path.includes('/')) {
+    // Reject reserved entry names, matching git's verify_path(): path separators,
+    // "." and ".." (which resolve outside the working directory), and ".git" (which git
+    // disallows as a path component). Checks mirror git's is_ntfs_dotgit() and
+    // is_hfs_dotgit(): case-insensitive, trailing dots/spaces stripped (NTFS),
+    // NTFS 8.3 short name aliases (git~1..git~9), and HFS+ ignorable Unicode
+    // characters stripped (zero-width joiners, directional marks, BOM, etc.).
+    const hfsClean = path.replace(
+      /[\u200C-\u200F\u202A-\u202E\u206A-\u206F\uFEFF]/g,
+      ''
+    );
+    const normalized = hfsClean.toLowerCase().replace(/[. ]+$/, '');
+    if (
+      path.includes('\\') ||
+      path.includes('/') ||
+      hfsClean === '.' ||
+      hfsClean === '..' ||
+      normalized === '.git' ||
+      /^\.?git~[1-9]$/.test(normalized)
+    ) {
       throw new UnsafeFilepathError(path)
     }