Repository navigation
git: refuse a Windows junction in a Git directory that leads outside --repository #5520
Description
Follow-up to GHSA-q74p-4wrc-q7w6, whose fix shipped in mcp-server-git 2026.11.11 (#5514) and leaves this case open. The advisory says so under "Not covered by this fix".
Problem
The fix (#5514) refuses a repository whose git directory holds a symbolic link resolving outside the allowed repository, and it walks the links it allows. On Windows, a directory junction inside the git directory is not reported as a link, so the check walks it like an ordinary directory instead of judging where it leads. Git follows junctions as it follows links. Windows only; POSIX hosts are unaffected.
Options
Treat a junction like a symbolic link in that walk: check where it resolves and refuse it if that is outside, using os.DirEntry.is_junction() / Path.is_junction() on Python 3.12 and later, with a reparse-point attribute check for 3.10 and 3.11, which the server still supports.
Acceptance
- On Windows, a junction in a git directory that resolves outside the allowed repository is refused like a symbolic link.
- A junction that stays inside is followed and checked, as an allowed link is.
- Tests run on the Windows CI leg and fail without the fix.
Activity
SalyyS1 commentedon Nov 11, 2026
I prepared a DCO-signed fix and tests for this on
v2/main: v2/main...SalyyS1:servers:fix/git-dir-windows-junction-5520Summary of changes
_is_junction(src/git/src/mcp_server_git/server.py): Usesos.DirEntry.is_junction()when available (Python 3.12+) and falls back tost_file_attributes & FILE_ATTRIBUTE_REPARSE_POINT(0x400) on Python 3.10/3.11._check_git_dir_contents: Treatsentry.is_symlink() or _is_junction(entry)identically so Windows directory junctions inside.gitthat resolve outside--repositoryare refused, and junctions that stay inside are walked (terminating on cycles).src/git/tests/test_protocol.py): Covers both branches of_is_junctionfor the Ubuntu per-file branch coverage gate (>= 90%) and adds Windows protocol tests usingmklink /Jfor outside and inside junctions.[-][GHSA-q74p-4wrc-q7w6 follow-up] - git: refuse a Windows junction in a Git directory that leads outside --repository[/-][+][GHSA-q74p-4wrc-q7w6 follow-up] - [/+][-][GHSA-q74p-4wrc-q7w6 follow-up] - [/-][+][GHSA-q74p-4wrc-q7w6 follow-up] - git: refuse a Windows junction in a Git directory that leads outside --repository[/+][-][GHSA-q74p-4wrc-q7w6 follow-up] - git: refuse a Windows junction in a Git directory that leads outside --repository[/-][+]git: refuse a Windows junction in a Git directory that leads outside --repository[/+]