{"record":{"id":"bd69d4a98b4b9b7d","repo":"zed-industries/zed","slug":"git-metadata-path-escapes-its-filesystem-root-pa","errorCode":null,"errorMessage":"git metadata path escapes its filesystem root: {path:?}","messagePattern":"git metadata path escapes its filesystem root: (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/git/src/repository.rs","lineNumber":95,"sourceCode":"    } else {\n        None\n    }\n}\n\nfn linked_worktree_git_dir(worktree_path: &Path) -> Result<PathBuf> {\n    let dot_git_path = worktree_path.join(\".git\");\n    let git_file = std::fs::read_to_string(&dot_git_path)\n        .with_context(|| format!(\"failed to read {}\", dot_git_path.display()))?;\n    let git_dir = git_file\n        .strip_prefix(\"gitdir:\")\n        .context(\"worktree .git file missing gitdir pointer\")?\n        .trim();\n    Ok(worktree_path.join(git_dir))\n}\n\nfn normalize_git_metadata_path(path: PathBuf) -> Result<PathBuf> {\n    paths::normalize_lexically(&path)\n        .map_err(|_| anyhow!(\"git metadata path escapes its filesystem root: {path:?}\"))\n}\n\n/// Commit data needed for the git graph visualization.\n#[derive(Debug, Clone)]\npub struct CommitData {\n    pub sha: Oid,\n    /// Most commits have a single parent, so we use a SmallVec to avoid allocations.\n    pub parents: SmallVec<[Oid; 1]>,\n    pub author_name: SharedString,\n    pub author_email: SharedString,\n    pub commit_timestamp: i64,\n    pub subject: SharedString,\n    pub message: SharedString,\n}\n\n#[derive(Debug)]\npub struct InitialGraphCommitData {\n    pub sha: Oid,","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/zed-industries/zed/blob/5a9b9558db01a6b906cec2fb70a797affdc58cdd/crates/git/src/repository.rs#L77-L113","documentation":"normalize_git_metadata_path rejected a git metadata path: lexically normalizing the path (e.g. the gitdir pointer read from a linked worktree's .git file) produced a result that escapes the filesystem root via '..' components. A malicious or corrupt .git file pointing outside the root triggers this security guard in Repository::new.","triggerScenarios":"Thrown at crates/git/src/repository.rs:95 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the worktree's .git file 'gitdir:' pointer — it must reference a path inside the git metadata root","Re-create the linked worktree with a healthy 'git worktree add' if the pointer is corrupt"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5a9b9558db01a6b906cec2fb70a797affdc58cdd","analyzedAt":"2026-08-20T19:29:52.058Z","contentChangedAt":"2026-08-20T19:29:52.058Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}