Copier URL encoding trust bypass vulnerability fix and analysis

Vulnerability Overview This vulnerability involves a trust bypass through encoded URL traversal. Specifically, percent-encoded parent directory segments in the template URL (such as , , , , , or backslashes , , ) can match the trusted URL prefix. However, after the HTTP server and Git transport decode these segments, they may ultimately resolve to a repository located outside the trusted prefix. This allows the execution of untrusted functionality from untrusted repositories. Scope of Impact Affected Component: The function in . Specific Impact: The trust check resolves path segments before decoding percent-encoded characters, causing a mismatch between the trust check and the actual server resolution. Additionally, encoded path separators ( ) and collapsed backslashes ( or ) are treated as path separators by some servers but as literal names by others. Remediation Fix Measures: Percent-encoded characters must be decoded before the trust check. Encoded separators ( ) and collapsed backslashes ( or ) must be collapsed into forward slashes, as some servers and intermediaries treat them as path separators while does not. Code Changes: - In , the module was imported, and decoding and collapsing logic was added to the function. - In , multiple test cases were added to verify the handling of different encoded paths. POC Code Test Cases ```python test/test_settings.py def test_load_settings_with_invalid_data(): [ ("https://github.com/user/.../evil/repo.git", True), { "https://github.com/user/%2e%2e/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e./evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E./evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2f/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2f/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2e%2e%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/user/%2E%2E%2F/evil/repo.git", ("https://github.com/user/", False), }, { "https://github.com/u

Goal Reached Thanks to every supporter — we hit 100%!

Copier URL encoding trust bypass vulnerability fix and analysis

More from this source