mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-08-25 08:33:55 +00:00
567a834477
* fix(core): read the stash reflog from the common git dir * fix(core): harden the commondir read the same way the HEAD read is `resolveCommonGitDir` reads `<gitDir>/commondir` with a plain `readFile`, while `gitDirect.ts` reads that same file through `readFirstLineNoFollow`, which opens with `O_NOFOLLOW | O_NONBLOCK` and bounds the read. The two reads had different protections against the same hostile input. That matters because `getGitWorkingTreeStatus` polls unattended: a `commondir` named pipe planted in a cloned repository would hang the `readFile` forever and pin a libuv thread-pool slot, and a symlink would be followed out of the repository. The adjacent `countStashEntries` already guards against exactly this hazard for the reflog it reads. Move `readFirstLineNoFollow` to `gitUtils.ts` and point both callers at it. It cannot be exported from `gitDirect.ts` because `gitDirect.ts` already imports `gitDiff.ts` — that would close an import cycle. `gitUtils.ts` imports nothing but node builtins, so it can be shared by both. |
||
|---|---|---|
| .. | ||
| acp-bridge | ||
| audio-capture | ||
| channels | ||
| chrome-extension | ||
| cli | ||
| core | ||
| cua-driver | ||
| desktop | ||
| mobile-mcp | ||
| sdk-java | ||
| sdk-python | ||
| sdk-typescript | ||
| vscode-ide-companion | ||
| web-shell | ||
| web-templates | ||
| webui | ||
| zed-extension | ||