pathutil

func IsDotGitName ¶

func IsDotGitName(name string) bool

IsDotGitName reports whether name is `.git` or its 8.3 NTFS short alias `git~1`, case-insensitively. Both are forbidden as path components (and as submodule names) because they refer to the repository's own metadata directory.

File names that do not conform to the 8.3 format (up to eight characters for the basename, three for the file extension) are associated with a so-called "short name" on NTFS — at least on the `C:` drive by default — which means that `git~1/` is a valid way to refer to `.git/`.

func IsHFSDot ¶

func IsHFSDot(part, needle string) bool

IsHFSDot reports whether part would be treated as ".<needle>" on an HFS+ filesystem after stripping ignored Unicode code points and folding ASCII to lower case. The needle is the lowercase ASCII suffix without the leading dot (e.g. "git", "gitmodules"). It mirrors upstream Git's is_hfs_dot_generic and is the building block of IsHFSDotGit / IsHFSDotGitmodules.

Reference: upstream Git utf8.c is_hfs_dot_generic at L741-L774 and the dotgit family at L784-L809 in tag v2.54.01.

func IsHFSDotGit ¶

func IsHFSDotGit(part string) bool

IsHFSDotGit reports whether part is an HFS+ equivalent of ".git".

func IsHFSDotGitmodules ¶

func IsHFSDotGitmodules(part string) bool

IsHFSDotGitmodules reports whether part is an HFS+ equivalent of ".gitmodules", catching attempts to plant the file via Unicode code points that HFS+ would strip during normalisation.

func IsNTFSDot ¶

func IsNTFSDot(name, dotgit, shortnamePrefix string) bool

IsNTFSDot ports upstream Git's is_ntfs_dot_generic. It detects NTFS path-component variants of a dotfile name that attackers can use to bypass case-insensitive comparisons against the canonical name on Windows. The dotgit parameter is the lowercase name without the leading dot (e.g. "gitmodules"); shortnamePrefix is the canonical 6-character NTFS short-name prefix used as a fall-back match (e.g. "gi7eba" for ".gitmodules").

Reference: upstream Git path.c is_ntfs_dot_generic at L1451-L1507 in tag v2.54.01.

func IsNTFSDotGit ¶

func IsNTFSDotGit(part string) bool

IsNTFSDotGit ports upstream Git's is_ntfs_dotgit. It detects path components that NTFS would resolve to ".git": the canonical name itself and its 8.3 short-name alias "git~1", each followed by any number of trailing spaces or periods (which NTFS silently trims) and an optional Alternate Data Stream suffix (":<stream>"). The bare strings ".git" and "git~1" also match, mirroring upstream.

Reference: upstream Git path.c is_ntfs_dotgit at L1415-L1449 in tag v2.54.01.

func IsNTFSDotGitmodules ¶

func IsNTFSDotGitmodules(part string) bool

IsNTFSDotGitmodules reports whether part is an NTFS-equivalent of ".gitmodules" — the file name (or any of its variants that NTFS would resolve to it) that attackers can use to plant submodule configuration disguised as a symlink. The 6-character canonical short-name prefix "gi7eba" mirrors upstream Git's is_ntfs_dotgitmodules.

func ValidTreePath ¶

func ValidTreePath(p string) error

ValidTreePath rejects path strings that, if materialised into a worktree, would let an attacker-controlled tree entry escape the worktree or rewrite repository metadata. It rejects:

• control characters (< 0x20, 0x7f);
• empty paths and "." / ".." components;
• Windows volume name prefixes (e.g. C:);
• .git, its 8.3 NTFS short-name git~1, plus their HFS+ and NTFS variants — at every position, not just the root.

HFS+/NTFS variants of `.git` are always rejected at this layer regardless of runtime config: tree paths are canonical UTF-8 with no zero-width characters or NTFS short-name forms, so an entry that looks like a disguised `.git` is suspicious anywhere. Windows reserved device names (CON, NUL, etc.) are not policed here — they are legitimate filenames on non-Windows filesystems and upstream Git accepts them. The wrapper layer (validPath in package git) rejects them at materialisation time when core.protectNTFS is on.

Mirrors upstream Git's verify_path_internal at read-cache.c#L987 in tag v2.54.01 with protect_hfs / protect_ntfs treated as always-on for `.git`-disguise detection (tree paths are not application-supplied) and is_valid_win32_path left to the wrapper.

func WindowsValidPath ¶

func WindowsValidPath(part string) bool

WindowsValidPath reports whether part is a valid Windows / NTFS path component for the worktree filesystem abstraction. It rejects NTFS-disguised variants of `.git` and `git~1` (trailing spaces, periods, Alternate Data Streams) and Windows reserved device names. Bare `.git` and `git~1` are allowed at this layer; the caller decides whether they are permissible at the current path position.