Skip to content

2606122012_hook-file-lstat-guard.md

Latest commit

 

History

History
61 lines (52 loc) · 2.6 KB

2606122012_hook-file-lstat-guard.md

File metadata and controls

61 lines (52 loc) · 2.6 KB
Raw
id 2606122012
title Add lstat guard to hook-file install, uninstall, and status
status ✅
summary S001 from the 2026-06-12 git/LSP audit: ensurePreMergeCommitHook, runPreMergeCommitUninstall, and runPreMergeCommitStatus all read, write, or remove the hook path without a prior lstat check. WriteGitattributes already uses the correct pattern. Apply it here.
model sonnet

Add lstat guard to hook-file install, uninstall, and status

Goal

Close finding S001 from the 2026-06-12 git/LSP audit report.

Three functions read, write, or remove the hook path without a prior lstat check:

  • ensurePreMergeCommitHook (cmd/mdsmith/mergedriver.go:728): os.ReadFile then os.WriteFile with no guard. A symlink at .git/hooks/pre-merge-commit causes both to follow it, writing to an arbitrary path outside the workspace.
  • runPreMergeCommitUninstall (cmd/mdsmith/premergecommit.go:137): os.ReadFile then os.Remove with no guard. A symlink causes Remove to delete an arbitrary file.
  • runPreMergeCommitStatus (cmd/mdsmith/premergecommit.go:186): os.ReadFile with no guard.

WriteGitattributes (internal/githooks/githooks.go:703) is the reference: lstatFile → reject if not regular → atomic temp-then-rename. The hook-file operations should match.

Tasks

  • Red: write a failing test for ensurePreMergeCommitHook that places a symlink at .git/hooks/pre-merge-commit and asserts the function returns an error instead of following the link.
  • Green: add an os.Lstat guard in ensurePreMergeCommitHook before os.ReadFile. Replace os.WriteFile with an atomic temp-then-rename helper (writeHookFile) mirroring writeGitattributesFile.
  • Red: write a failing test for runPreMergeCommitUninstall that places a symlink and asserts os.Remove is not called.
  • Green: add lstat guards in runPreMergeCommitUninstall before os.ReadFile and before os.Remove; reject if not regular.
  • Red/Green: add lstat guard to the runPreMergeCommitStatus os.ReadFile call; reject symlinks before reading.
  • Run go test ./cmd/mdsmith/... ./internal/...; all pass.
  • Run go run ./cmd/mdsmith check .; no regressions.

Acceptance Criteria

  • A symlink at .git/hooks/pre-merge-commit causes merge-driver install, pre-merge-commit install, pre-merge-commit uninstall, and pre-merge-commit status to each return a clear error instead of following the link.
  • The fix uses the same pattern as WriteGitattributes.
  • All existing tests pass.