fix(index): confine staging reads to worktree files

`IndexFile.add()` could read through intermediate directory symlinks and
store files outside the working tree. Null-SHA `Blob` and
`BaseIndexEntry` inputs reached the same reader, while unsafe entry and
rewritten paths could enter the in-memory index with `write=False`
(finding 21501).

Validate supplied object paths and all final entry paths with the shared
repository path checker. Confine filesystem inputs in `_store_path()`
and reject intermediate symlinks or redirected directories before
opening files. Preserve final symlinks as links, including when rewriting
paths, and reject special files. Use `O_NOFOLLOW` and `O_NONBLOCK` where
available and check the opened regular file with `fstat()`.

Skip Git metadata during directory expansion and stage directory
symlinks themselves. Validate complete relative directory paths so nested
POSIX colon names are not mistaken for drive-prefixed paths.

Parent-directory checks handle the existing filesystem layout; they do
not make staging atomic against concurrent directory replacement. The
open flags protect final-component substitution on supporting platforms.

Tests cover path/glob/object inputs, inside and outside symlink targets,
rewriters, in-memory index validation, metadata exclusion, directory
symlinks, special files, and nested colon names. Validation: 129 combined
tree/index tests passed, with two platform skips; Ruff checks and
formatting checks passed.

Windows CI exposed an existing symlink-storage bug: `lstat().st_size`
can be zero for a link, so the object database stored an empty target.
Read and encode the link target once and advertise its actual byte
length, while retaining `fstat()` sizing for regular files. Compare the
native `readlink()` representation in the directory-symlink test rather
than assuming separator spelling. A portable regression supplies zero
symlink metadata size and a multibyte target; it fails before the fix and
passes afterward. All 53 selected staging/index tests pass, with two
platform skips; locked Basedpyright, mypy, and all pre-commit hooks pass.

Author: codex

git/index/base.py

@@ -14,7 +14,7 @@
 from io import BytesIO
 import os
 import os.path as osp
-from stat import S_ISLNK
+from stat import S_ISLNK, S_ISREG
 import subprocess
 import sys
 import tempfile
@@ -36,6 +36,7 @@
     file_contents_ro,
     _is_path_rooted,
     _to_relative_path,
+    _validate_repo_path,
     to_native_path_linux,
     unbare_repo,
     to_bin_sha,
@@ -476,7 +477,17 @@ def raise_exc(e: Exception) -> NoReturn:
                     continue
             # END glob handling
             try:
-                for root, _dirs, files in os.walk(abs_path, onerror=raise_exc):
+                for root, dirs, files in os.walk(abs_path, onerror=raise_exc):
+                    for dirname in dirs[:]:
+                        directory = osp.join(root, dirname)
+                        try:
+                            _validate_repo_path(to_native_path_linux(osp.relpath(directory, r)))
+                        except ValueError:
+                            dirs.remove(dirname)
+                            continue
+                        if osp.islink(directory):
+                            dirs.remove(dirname)
+                            yield osp.relpath(directory, r)
                     for rela_file in files:
                         # Add relative paths only.
                         yield osp.join(root.replace(rs, ""), rela_file)
@@ -717,6 +728,8 @@ def _preprocess_add_items(
             else:
                 raise TypeError("Invalid Type: %r" % item)
         # END for each item
+        for entry in entries:
+            _validate_repo_path(entry.path)
         return paths, entries
 
     def _store_path(self, filepath: PathLike, fprogress: Callable) -> BaseIndexEntry:
@@ -726,20 +739,43 @@ def _store_path(self, filepath: PathLike, fprogress: Callable) -> BaseIndexEntry
             This needs the :func:`~git.index.util.git_working_dir` decorator active!
             This must be ensured in the calling code.
         """
-        st = os.lstat(filepath)  # Handles non-symlinks as well.
-
+        filepath = self._to_relative_path(filepath)
+        _validate_repo_path(filepath)
+        parent = osp.realpath(self.repo.working_dir)
+        for component in os.fspath(filepath).split("/")[:-1]:
+            parent = osp.join(parent, component)
+            if osp.islink(parent) or osp.normcase(osp.realpath(parent)) != osp.normcase(osp.abspath(parent)):
+                raise ValueError("Cannot stage a path beyond a symbolic link: %r" % filepath)
+        st = os.lstat(filepath)
+        if not S_ISLNK(st.st_mode) and not S_ISREG(st.st_mode):
+            raise ValueError("Can only stage a regular file or symbolic link: %r" % filepath)
+
+        stream_size = st.st_size
         if S_ISLNK(st.st_mode):
             # readlink is a string, but we need bytes.
+            target = force_bytes(os.readlink(filepath), encoding=defenc)
+            stream_size = len(target)
+
             def open_stream() -> BinaryIO:
-                return BytesIO(force_bytes(os.readlink(filepath), encoding=defenc))
+                return BytesIO(target)
         else:
 
             def open_stream() -> BinaryIO:
-                return open(filepath, "rb")
+                # Do not follow a final symlink or block on a FIFO substituted
+                # between lstat and open on platforms supporting these flags.
+                def opener(path: str, flags: int) -> int:
+                    return os.open(path, flags | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0))
+
+                return open(filepath, "rb", opener=opener)
 
         with open_stream() as stream:
+            if not S_ISLNK(st.st_mode):
+                st = os.fstat(stream.fileno())
+                if not S_ISREG(st.st_mode):
+                    raise ValueError("Can only stage a regular file: %r" % filepath)
+                stream_size = st.st_size
             fprogress(filepath, False, filepath)
-            istream = self.repo.odb.store(IStream(Blob.type, st.st_size, stream))
+            istream = self.repo.odb.store(IStream(Blob.type, stream_size, stream))
             fprogress(filepath, True, filepath)
         return BaseIndexEntry(
             (
@@ -777,7 +813,7 @@ def _entries_for_paths(
                 blob = Blob(
                     self.repo,
                     Blob.NULL_BIN_SHA,
-                    stat_mode_to_index_mode(os.stat(abspath).st_mode),
+                    stat_mode_to_index_mode(os.lstat(abspath).st_mode),
                     to_native_path_linux(gitrelative_path),
                 )
                 # TODO: variable undefined
@@ -989,6 +1025,8 @@ def handle_null_entries(self: "IndexFile") -> None:
 
         # FINALIZE
         # Add the new entries to this instance.
+        for entry in entries_added:
+            _validate_repo_path(entry.path)
         for entry in entries_added:
             self.entries[(entry.path, 0)] = IndexEntry.from_base(entry)
 

test/test_index_add_security.py

@@ -0,0 +1,110 @@
+# This module is part of GitPython and is released under the
+# 3-Clause BSD License: https://opensource.org/license/bsd-3-clause/
+
+import os
+from stat import S_ISLNK
+from unittest import mock
+
+import pytest
+
+from git import Blob, Repo
+from git.index.typ import BaseIndexEntry
+
+
+@pytest.mark.parametrize("kind", ["path", "glob", "blob", "entry"])
+@pytest.mark.parametrize("outside", [False, True])
+def test_staging_never_reads_through_a_directory_symlink(tmp_path, kind, outside):
+    with Repo.init(tmp_path / "repo") as repo:
+        root = tmp_path / "repo"
+        target = (tmp_path if outside else root) / "target"
+        target.mkdir()
+        (target / "secret").write_text("private data")
+        try:
+            (root / "link").symlink_to(target, target_is_directory=True)
+        except OSError:
+            pytest.skip("Symlinks unavailable")
+        item = "link/secret"
+        if kind == "glob":
+            item = "link/*"
+        elif kind == "blob":
+            item = Blob(repo, Blob.NULL_BIN_SHA, 0o100644, item)
+        elif kind == "entry":
+            item = BaseIndexEntry((0o100644, Blob.NULL_BIN_SHA, 0, item))
+        with mock.patch.object(repo.odb, "store", wraps=repo.odb.store) as store:
+            with pytest.raises(ValueError, match="symbolic link"):
+                repo.index.add([item], write=False)
+            store.assert_not_called()
+
+
+@pytest.mark.parametrize("kind", ["blob", "entry", "rewriter"])
+def test_staging_rejects_unsafe_object_paths_even_without_writing(tmp_path, kind):
+    with Repo.init(tmp_path) as repo:
+        entry = BaseIndexEntry((0o100644, b"a" * 20, 0, "../outside"))
+        item = Blob(repo, entry.binsha, entry.mode, entry.path) if kind == "blob" else entry
+        kwargs = {}
+        if kind == "rewriter":
+            item = BaseIndexEntry((0o100644, b"a" * 20, 0, "safe"))
+            kwargs["path_rewriter"] = lambda entry: "../outside"
+        index = repo.index
+        with pytest.raises(ValueError):
+            index.add([item], write=False, **kwargs)
+        assert not index.entries
+
+
+def test_staging_root_preserves_symlinks_and_skips_git_metadata(tmp_path):
+    root = tmp_path / "repo"
+    (tmp_path / "outside").mkdir()
+    with Repo.init(root) as repo:
+        (root / "file").write_text("contents")
+        try:
+            (root / "link").symlink_to("../outside", target_is_directory=True)
+        except OSError:
+            pytest.skip("Symlinks unavailable")
+        entries = repo.index.add(["."])
+        assert {entry.path for entry in entries} == {"file", "link"}
+        link = repo.index.entries[("link", 0)]
+        assert link.mode == 0o120000
+        assert repo.odb.stream(link.binsha).read() == os.fsencode(os.readlink(root / "link"))
+
+
+def test_staging_symlink_measures_encoded_target_instead_of_stat_size(tmp_path):
+    with Repo.init(tmp_path) as repo:
+        link = tmp_path / "link"
+        try:
+            link.symlink_to("../café", target_is_directory=True)
+        except OSError:
+            pytest.skip("Symlinks unavailable")
+        target = os.fsencode(os.readlink(link))
+        original_lstat = os.lstat
+
+        def zero_size_for_symlinks(*args, **kwargs):
+            result = original_lstat(*args, **kwargs)
+            if S_ISLNK(result.st_mode):
+                fields = list(result)
+                fields[6] = 0
+                return os.stat_result(fields)
+            return result
+
+        with mock.patch("os.lstat", side_effect=zero_size_for_symlinks):
+            (entry,) = repo.index.add(["link"])
+        assert entry.mode == 0o120000
+        assert repo.odb.stream(entry.binsha).read() == target
+
+
+@pytest.mark.skipif(os.name == "nt", reason="Colons are not valid Windows filenames")
+def test_staging_nested_colon_directory(tmp_path):
+    with Repo.init(tmp_path) as repo:
+        directory = tmp_path / "nested" / "a:b"
+        directory.mkdir(parents=True)
+        (directory / "file").write_text("contents")
+        assert [entry.path for entry in repo.index.add(["nested"])] == ["nested/a:b/file"]
+        assert repo.index.write_tree()["nested/a:b/file"].data_stream.read() == b"contents"
+
+
+@pytest.mark.skipif(not hasattr(os, "mkfifo"), reason="FIFOs unavailable")
+def test_staging_special_files_fails_before_opening(tmp_path):
+    with Repo.init(tmp_path) as repo:
+        os.mkfifo(tmp_path / "fifo")
+        with mock.patch("builtins.open", side_effect=AssertionError("must not open a FIFO")):
+            with pytest.raises(ValueError, match="regular file"):
+                repo.index.add(["fifo"], write=False)