{"record":{"id":"6c92ce94c48e0ab7","repo":"abhigyanpatwari/GitNexus","slug":"clone-contains-unsafe-or-unbounded-remote-metadata","errorCode":null,"errorMessage":"clone contains unsafe or unbounded remote metadata","messagePattern":"clone contains unsafe or unbounded remote metadata","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/oracle_assets.py","lineNumber":374,"sourceCode":"    refs_output = _git_checked(\n        root,\n        [\"for-each-ref\", f\"--count={MAX_CLONE_REFS + 1}\", \"--format=%(refname)\"],\n        timeout=60,\n    )\n    refs = refs_output.splitlines() if refs_output else []\n    if len(refs) > MAX_CLONE_REFS:\n        raise ValueError(f\"clone has more than {MAX_CLONE_REFS} references; refusing incomplete sanitization\")\n    if any(not ref.startswith(\"refs/\") or any(character.isspace() for character in ref) for ref in refs):\n        raise ValueError(\"clone contains an unsafe reference name\")\n    for ref in refs:\n        _git_checked(root, [\"update-ref\", \"--no-deref\", \"-d\", ref], timeout=60)\n\n    remote_output = _git_checked(root, [\"remote\"], timeout=60)\n    remotes = remote_output.splitlines() if remote_output else []\n    if len(remotes) > MAX_CLONE_REFS or any(\n        re.fullmatch(r\"[A-Za-z0-9][A-Za-z0-9._/-]{0,255}\", remote) is None or \"..\" in remote for remote in remotes\n    ):\n        raise ValueError(\"clone contains unsafe or unbounded remote metadata\")\n    for remote in remotes:\n        _git_checked(root, [\"remote\", \"remove\", remote], timeout=60)\n\n    _git_checked(\n        root,\n        [\"reflog\", \"expire\", \"--expire=now\", \"--expire-unreachable=now\", \"--all\"],\n        timeout=60,\n    )\n    git_dir = root / \".git\"\n    for pseudo_ref in (\n        \"AUTO_MERGE\",\n        \"BISECT_START\",\n        \"CHERRY_PICK_HEAD\",\n        \"FETCH_HEAD\",\n        \"MERGE_HEAD\",\n        \"ORIG_HEAD\",\n        \"REBASE_HEAD\",\n        \"REVERT_HEAD\",","sourceCodeStart":356,"sourceCodeEnd":392,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/oracle_assets.py#L356-L392","documentation":"`git remote` output is bounded (<=MAX_CLONE_REFS entries) and each name must match [A-Za-z0-9][A-Za-z0-9._/-]{0,255} with no '..'. The guard prevents argument injection into `git remote remove <name>` and bounds the deletion loop. Names failing the regex or exceeding the count abort.","triggerScenarios":"Triggered when the clone has more than 1024 remotes, or any remote name contains shell/argument-special characters, whitespace, leading dot, or '..'.","commonSituations":"A clone with many added remotes from a migration; a crafted clone whose .git/config defines a remote name with newlines or dashes positioned to break `git remote remove`.","solutions":["Inspect `git -C <clone> remote -v` and remove unneeded remotes: `git -C <clone> remote remove <name>`.","Re-clone from a single trusted origin so only 'origin' is present.","If a remote name is malformed, edit .git/config directly or re-clone."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import re\nfrom pathlib import Path\nfrom eval.workflow_bench.oracle_assets import MAX_CLONE_REFS\nfrom eval.workflow_bench.process_control import run_checked\n\n_REMOTE = re.compile(r\"[A-Za-z0-9][A-Za-z0-9._/-]{0,255}\")\ndef remotes_are_safe(clone: Path) -> bool:\n    out = run_checked([\"git\", \"-C\", str(clone), \"remote\"], timeout=60).stdout_tail.strip()\n    names = out.splitlines()\n    if len(names) > MAX_CLONE_REFS:\n        return False\n    for n in names:\n        if _REMOTE.fullmatch(n) is None or \"..\" in n:\n            return False\n    return True\n","typeGuard":"def is_unsafe_remote(exc: BaseException) -> bool:\n    return isinstance(exc, ValueError) and \"unsafe or unbounded remote metadata\" in str(exc)\n","tryCatchPattern":"try:\n    oracle_assets.sanitize_clone_for_hidden_oracles(clone)\nexcept ValueError as exc:\n    quarantine(clone)\n    raise AbortTask(str(exc)) from exc\n","preventionTips":["Benchmark clones should carry only one remote (origin).","Do not propagate developer .git/config with extra remotes into the benchmark clone."],"tags":["git","remote","argument-injection","security","oracle","sanitization","invariant"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}