fix: validate safe.directory path before writing to global git config

[matiaspalmac]

[Fix]: Validate safe.directory path before writing to the global git config

Description

git_add_safe_directory forwarded the caller-supplied path straight to
git config --global --add safe.directory. Because the target config is
global and persistent, any junk that made it through ended up in
the user's ~/.gitconfig. The worst shape is *, which
auto-whitelists every repository on disk — from that point on any
untrusted repo opened by the user can run pre/post hooks without the
usual dubious-ownership prompt.

Change

apps/desktop/src-tauri/src/lib.rs — git_add_safe_directory now
validates before shelling out:

• Reject empty input, *, and any value starting with - so it
  cannot be reparsed as a git flag (e.g. --global --get).
• Path::canonicalize the input and require the result to be an
  existing directory. The only in-tree caller
  (GitExplorerComponent.tsx → "fix dubious ownership" confirmation)
  always passes the current workspace root, which is a real directory
  on disk, so legitimate usage is unchanged.
• Strip the \\?\ verbatim prefix on Windows before handing the value
  to git config. Git writes entries in plain form and does not
  recognize the UNC-verbatim variant, so this keeps the config entry
  readable and matches what the user saw in the UI confirmation.

The user-facing confirmation dialog in GitExplorerComponent already
shows the exact path being added; canonicalization now makes that
dialog match what actually lands in the global config instead of
whatever string the frontend happened to send.

Trade-offs

• Enforcing canonical == workspace_root as suggested in the issue
  would require threading the workspace root through an extra Tauri
  command argument, and the frontend can trivially fake it anyway.
  The real defense — "the value must be a real directory, not a
  wildcard or flag" — is applied here. A deeper workspace-scoping
  check is out of scope for this security fix.
• Non-existent paths now fail loudly instead of silently being
  written to global config. The one legitimate caller always passes
  an existing directory, so no behavior changes for the happy path.

Verification

• cargo check and cargo clippy -- -D warnings on src-tauri → clean.
• Manual trace of the validation branches:
  • "" → safe.directory path is empty.
  • "*" → refused with the wildcard-specific message.
  • "--global" → refused for leading -.
  • "/path/that/does/not/exist" → canonicalize error.
  • "C:\\path\\to\\a\\file.txt" → must be a directory.
  • Current workspace root → canonicalized, UNC-verbatim prefix
    stripped, written to global config (matches previous behavior).

Related Issue

Fixes #57

Checklist

• I have tested this on the latest version.
• I have followed the project's coding guidelines.
• My changes generate no new warnings or errors.
• I have verified the fix on:
  • OS: Windows
  • Version: v1.0.10

[github-actions]

Thanks for the contribution! I'll review it as soon as possible. If you have still changes, please mark this PR as draft and all reviews will be cancelled. Tests reviews will be re-run only when the PR is marked as ready for review.

[Copilot]

Pull request overview

This PR hardens the Tauri backend command that adds safe.directory entries to the user’s global git config by validating and normalizing the provided path before invoking git config --global --add.

Changes:

• Rejects unsafe safe.directory values (empty, *, and leading -).
• Canonicalizes the path and requires it to be an existing directory.
• Attempts to normalize Windows verbatim (\\?\) paths before writing to git config.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.