{"record":{"id":"a30231a640827aa2","repo":"jdx/mise","slug":"too-many-inherited-git-configuration-entries","errorCode":null,"errorMessage":"too many inherited Git configuration entries","messagePattern":"too many inherited Git configuration entries","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/github_relay.rs","lineNumber":846,"sourceCode":"            child.args(&command[1..]);\n            child\n        };\n        let executable = std::env::current_exe()?;\n        let mut paths = vec![\n            executable\n                .parent()\n                .ok_or_else(|| eyre::eyre!(\"missing mise executable directory\"))?\n                .to_path_buf(),\n        ];\n        paths.extend(std::env::split_paths(\n            &std::env::var_os(\"PATH\").unwrap_or_default(),\n        ));\n        child.env(\"PATH\", std::env::join_paths(paths)?);\n        let count: usize = std::env::var(\"GIT_CONFIG_COUNT\")\n            .unwrap_or_else(|_| \"0\".into())\n            .parse()?;\n        if count > 1000 {\n            bail!(\"too many inherited Git configuration entries\");\n        }\n        let base = format!(\"http://{address}/{capability}/git/\");\n        for (index, source) in [\n            \"https://github.com/\",\n            \"git@github.com:\",\n            \"ssh://git@github.com/\",\n        ]\n        .iter()\n        .enumerate()\n        {\n            child.env(\n                format!(\"GIT_CONFIG_KEY_{}\", count + index),\n                format!(\"url.{base}.insteadOf\"),\n            );\n            child.env(format!(\"GIT_CONFIG_VALUE_{}\", count + index), source);\n        }\n        child\n            .env(\"GIT_CONFIG_COUNT\", (count + 3).to_string())","sourceCodeStart":828,"sourceCodeEnd":864,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/github_relay.rs#L828-L864","documentation":"When spawning a git child process, the session inherits the environment and forwards GIT_CONFIG_COUNT-based config entries. Because huge GIT_CONFIG_COUNT values can make git read arbitrary numbers of config files (a known injection/DoS vector), the session caps it at 1000 entries and fails with \"too many inherited Git configuration entries\" if the inherited environment exceeds that.","triggerScenarios":"Running the relay session in an environment where GIT_CONFIG_COUNT is set above 1000 — e.g. inherited from a parent CI job, a malicious/buggy wrapper script, or tooling that appends config entries without bound.","commonSituations":"Nested tool invocations (mise inside mise, CI inside CI) where each layer appends git config entries; a poisoned environment from an untrusted repo's config hooks; scripts that increment GIT_CONFIG_COUNT per setting over a long session.","solutions":["Clear or lower GIT_CONFIG_COUNT before starting the session (unset it or set it to the actual number of GIT_CONFIG_KEY_N/GIT_CONFIG_VALUE_N pairs).","Audit the parent environment/CI wrapper that is setting hundreds/thousands of git config entries.","Pass needed git config via a config file or -c arguments on the git command instead of the counted-environment mechanism."],"exampleFix":"// before\nexport GIT_CONFIG_COUNT=2000  # set by an accumulating wrapper\n// after\nunset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0  # or set to real pair count","handlingStrategy":"validation","validationCode":"let count: usize = std::env::var(\"GIT_CONFIG_COUNT\")\n    .unwrap_or_else(|_| \"0\".into())\n    .parse()\n    .unwrap_or(0);\nif count > 1000 {\n    // unset GIT_CONFIG_COUNT and its KEY/VALUE pairs before launching\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep GIT_CONFIG_COUNT at or below the real number of config pairs you set.","Avoid nesting tools that each append git config entries without cleanup.","Prefer git config files or -c flags over the counted-environment mechanism."],"tags":["git","environment","security","limit-exceeded"],"backgroundTag":"invalid-env-var-value","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}