JGit fetch accepts traversal-shaped remote refs and overwrites a sibling repository ref #299

Version

7.8.0.202609011348-r

Operating System

Linux/Unix

Bug description

JGit's fetch client accepts a remote-advertised ref name containing .. and
carries it through the default bare-clone refspec into the file-backed ref
database. The attached server advertises:

refs/heads/../../../victim.git/refs/heads/main

The first bare clone records the logical ref. On a subsequent fetch, the
expanded destination resolves outside the target repository and addresses the
main ref in a sibling victim.git repository.

Actual behavior

The fetch completes successfully and replaces the sibling repository's ref
with the object ID supplied by the remote:

target=target.git
victim-ref=victim.git/refs/heads/main
victim-ref-replaced=true
victim-ref-content=286060ec85628e19c00857f70f34805a115130f7

Expected behavior

The remote ref should be rejected before it enters the local refspec and
file-backed ref update path. The sibling repository's ref should remain
unchanged, and no traversal-shaped ref should be persisted in the target
repository.

Relevant log output

JGit 7.8.0.202609011348-r: victim-ref-replaced=true
JGit 7.9.0-SNAPSHOT (87ec2100): victim-ref-replaced=true
Git core check-ref-format control: rejected

Other information

This gives an untrusted Git server a path traversal into a sibling repository
whenever a JGit client fetches into a filesystem containing other writable
repositories. Repository mirrors, bare caches, build inputs, and server-side
management jobs can have another checkout's branch redirected by a successful
fetch.

The reproducer is a standalone Maven project that uses JGit as both the local
client and test server. It requires Java 17 or newer and Maven 3.8 or newer;
Maven resolves the pinned release dependency. The detailed protocol and
filesystem source analysis is in report.md, and the complete
reproducer and sanitized evidence are in attachments.zip.

Relevant source paths at the audited revision include
BasePackConnection,
RefSpec,
and RefDirectory.fileFor.

Attachments

detailed report.md

attachments.zip