🛡️ Sentinel: [HIGH] Fix command injection in git clone mirror

[google-labs-jules]

🚨 Severity: HIGH
💡 Vulnerability: User-supplied repository paths or names starting with - could be interpreted as command-line flags by git clone --mirror in fork_repo.
🎯 Impact: This could allow a malicious user to inject arbitrary git flags, leading to unexpected file operations, data leakage, or arbitrary command execution via features like core.hooksPath.
🔧 Fix: Appended the -- separator before the positional path arguments, forcing git to treat them strictly as file paths.
✅ Verification: cargo clippy and cargo check compile successfully, and the patch has passed code review.

---

PR created automatically by Jules for task 632155665144112829 started by @euxaristia

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[github-actions]

Thanks for the contribution. A couple of things will help us review this faster:

• Link the issue this addresses (Closes #123). For protocol changes, open an issue first.
• This changes Rust source but no tests changed. Tests are required for fixes and strongly encouraged for features.

See CONTRIBUTING.md. Update the PR and these notes will clear automatically.

[euxaristia]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 347dbe85-b84e-4179-bd7a-e5f5b6f800f0

📥 Commits

Reviewing files that changed from the base of the PR and between e4c7458 and 4455911.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• .jules/sentinel.md
• crates/gitlawb-node/src/api/repos.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The fork operation now passes -- to git clone --mirror before external paths. A security note documents the command-injection risk and the option-termination fix.

Changes

Git clone security

Layer / File(s)	Summary
Terminate Git clone options crates/gitlawb-node/src/api/repos.rs, .jules/sentinel.md	The mirror clone command inserts -- before source and destination paths. The security note documents the related command-injection risk.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 44559

The fork command now treats repository paths strictly as paths, preventing option injection while preserving existing behavior; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: beardthelion, gravirei, kevincodex1

Poem

A rabbit checked the clone command line,
And placed -- before paths in time.
No dash-led path can change the track,
The mirror hops safely forward and back.
Documentation leaves a careful sign:
“Stop options here; the paths are mine.”

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the vulnerability, impact, fix, and verification, but it omits most required template sections and test evidence.	Use the repository template and add the change list, reproducible verification steps, test results, and completed pre-review checklist.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the high-severity command-injection fix in the git clone mirror operation.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[euxaristia]

Closing in favor of upstreaming to Gitlawb/node