fix(submodule): apply git's transport policy to .gitmodules URLs

`Submodule.update` clones a submodule from the URL recorded in
`.gitmodules`, and fetches the remotes of an initialized submodule, with
the transport policy git applies to a URL the user typed. Since git
2.38.1 (CVE-2022-39253) `protocol.file.allow` defaults to `user`, and
`git submodule update` runs its clones and fetches with
`GIT_PROTOCOL_FROM_USER=0`, so git refuses the `file` transport for a
URL that comes from `.gitmodules` unless `protocol.file.allow=always` is
configured. GitPython did not set that variable, so a `.gitmodules` like

    [submodule "module"]
        path = module
        url = /path/on/the/victims/machine

made `Repo.submodule_update(init=True)` and `Submodule.update(init=True)`
clone that local repository into the checkout, and `RootModule.update`
fetch from such a URL when a new commit changed it, while
`git submodule update --init` fails with `fatal: transport 'file' not
allowed`. Whoever authored the superproject controls `.gitmodules`, so a
tool that updates the submodules of repositories it is given copied a
local repository of the author's choosing through git's local clone
path, which hardlinks objects and skips the fsck checks a transport
fetch applies.

`Submodule.update` now runs the clone and the fetch of every remote with
`GIT_PROTOCOL_FROM_USER=0`, and `RootModule.update` does the same for
the fetch from a changed URL. Git then applies its own policy: `http`,
`https`, `git` and `ssh` are unaffected, while `file` and any other
protocol whose `protocol.<name>.allow` is `user` is refused unless
`always` is configured, the same opt-in `git submodule update` honors.
`allow_unsafe_protocols=True` on `Submodule.update` keeps treating the
URL as the caller's, and a `GIT_PROTOCOL_FROM_USER` value in the `env`
passed to `update` still wins. `Submodule.add` is unchanged because its
URL is supplied by the caller.

The tests that update submodules from local repositories now set
`protocol.file.allow=always`, as the ones that call `git submodule add`
already did; the helper for that moved from `test/test_submodule.py` to
`test/lib/helper.py` as `patch_git_config` because
`test/test_submodule_no_fetch.py` and `test/test_docs.py` need it too.
Adds `test_update_applies_git_transport_policy_to_gitmodules_url` and
`test_root_update_applies_git_transport_policy_to_changed_url` in
`test/test_submodule.py`, which fail before this change and pass after.
`ruff check`, `ruff format --check` and `mypy` pass. The pytest suite
passes except for eight tests that fail the same way without this
change in a clone not prepared with `init-tests-after-clone.sh`.

Author: Keerthana-64

git/objects/submodule/base.py

@@ -361,6 +361,21 @@ def _module_abspath(
             )
         raise NotADirectoryError()
 
+    @classmethod
+    def _transport_env(cls, allow_unsafe_protocols: bool = False) -> Dict[str, str]:
+        """
+        :return:
+            Environment for clones and fetches whose URL comes from ``.gitmodules``.
+
+            :manpage:`git-submodule(1)` runs those with ``GIT_PROTOCOL_FROM_USER=0``, so
+            that git refuses every transport whose ``protocol.<name>.allow`` policy is
+            ``user``, which it is for ``file`` since git 2.38.1, unless the user
+            configured ``protocol.<name>.allow=always``.
+        """
+        if allow_unsafe_protocols:
+            return {}
+        return {"GIT_PROTOCOL_FROM_USER": "0"}
+
     @classmethod
     def _clone_repo(
         cls,
@@ -849,7 +864,10 @@ def update(
             They only take effect with the `init` option.
 
         :param allow_unsafe_protocols:
-            Allow unsafe protocols to be used, like ``ext``.
+            Allow unsafe protocols to be used, like ``ext``. This also runs the clone
+            and the fetches as if their URL came from the user, so that git accepts a
+            transport whose ``protocol.<name>.allow`` policy is ``user``, such as
+            ``file``, without ``protocol.<name>.allow=always`` being configured.
 
         :param allow_unsafe_options:
             Allow unsafe options to be used, like ``--upload-pack``.
@@ -900,7 +918,8 @@ def fetch_remotes(module_repo: "Repo") -> None:
                 )
                 # ===============================
                 if not dry_run:
-                    remote.fetch(progress=progress)
+                    with module_repo.git.custom_environment(**self._transport_env(allow_unsafe_protocols)):
+                        remote.fetch(progress=progress)
                 # END handle dry-run
                 # ===============================
                 if i == len_rmts - 1:
@@ -987,7 +1006,7 @@ def fetch_remotes(module_repo: "Repo") -> None:
                             self.path,
                             self.name,
                             n=True,
-                            env=env,
+                            env={**self._transport_env(allow_unsafe_protocols), **(env or {})},
                             multi_options=clone_multi_options,
                             allow_unsafe_options=allow_unsafe_options,
                             allow_unsafe_protocols=allow_unsafe_protocols,

git/objects/submodule/root.py

@@ -305,7 +305,8 @@ def update(  # type: ignore[override]
                                 else:
                                     assert nn not in [r.name for r in rmts]
                                     smr = smm.create_remote(nn, sm_url)
-                                    smr.fetch(progress=progress)
+                                    with smm.git.custom_environment(**sm._transport_env()):
+                                        smr.fetch(progress=progress)
 
                                     # If we have a tracking branch, it should be available
                                     # in the new remote as well.

test/lib/helper.py

@@ -10,6 +10,7 @@
     "with_rw_directory",
     "with_rw_repo",
     "with_rw_and_rw_remote_repo",
+    "patch_git_config",
     "PathLikeMock",
     "TestBase",
     "VirtualEnvironment",
@@ -39,6 +40,7 @@
 import textwrap
 import time
 import unittest
+from unittest import mock
 import venv
 from typing import Union, Type, Tuple
 
@@ -84,6 +86,26 @@ def fixture(name):
 # { Adapters
 
 
+@contextlib.contextmanager
+def patch_git_config(name, value):
+    """Temporarily add a git config name-value pair, using environment variables."""
+    pair_index = int(os.getenv("GIT_CONFIG_COUNT", "0"))
+
+    # This is recomputed each time the context is entered, for compatibility with
+    # existing GIT_CONFIG_* environment variables, even if changed in this process.
+    patcher = mock.patch.dict(
+        os.environ,
+        {
+            "GIT_CONFIG_COUNT": str(pair_index + 1),
+            f"GIT_CONFIG_KEY_{pair_index}": name,
+            f"GIT_CONFIG_VALUE_{pair_index}": value,
+        },
+    )
+
+    with patcher:
+        yield
+
+
 class StringProcessAdapter:
     """Allows strings to be used as process objects returned by subprocess.Popen.
 

test/test_docs.py

@@ -8,7 +8,7 @@
 import os.path
 
 from test.lib import TestBase
-from test.lib.helper import with_rw_directory, with_rw_repo
+from test.lib.helper import patch_git_config, with_rw_directory, with_rw_repo
 
 
 class Tutorials(TestBase):
@@ -479,6 +479,7 @@ def test_references_and_objects(self, rw_dir):
         repo.git.clear_cache()
 
     @with_rw_repo("c15a6e1923a14bc760851913858a3942a4193cdb")
+    @patch_git_config("protocol.file.allow", "always")
     def test_submodules(self, repo):
         # [1-test_submodules]
         sms = repo.submodules