fix tests for submodules for CVE-2022-39253

testing/fixtures.py

@@ -146,3 +146,12 @@ def make_consuming_repo(tempdir_factory, repo_source):
     config = make_config_from_repo(path)
     git_path = git_dir(tempdir_factory)
     return add_config_to_repo(git_path, config)
+
+
+def git_submodule_add(repo, dest, *, cwd='.'):
+    cmd_output(
+        'git',
+        '-c', 'protocol.file.allow=always',
+        '-C', cwd,
+        'submodule', 'add', repo, dest,
+    )

tests/commands/install_uninstall_test.py

@@ -20,6 +20,7 @@
 from pre_commit.util import resource_text
 from testing.fixtures import add_config_to_repo
 from testing.fixtures import git_dir
+from testing.fixtures import git_submodule_add
 from testing.fixtures import make_consuming_repo
 from testing.fixtures import remove_config_from_repo
 from testing.fixtures import write_config
@@ -176,7 +177,7 @@ def test_install_pre_commit_and_run_custom_path(tempdir_factory, store):
 def test_install_in_submodule_and_run(tempdir_factory, store):
     src_path = make_consuming_repo(tempdir_factory, 'script_hooks_repo')
     parent_path = git_dir(tempdir_factory)
-    cmd_output('git', 'submodule', 'add', src_path, 'sub', cwd=parent_path)
+    git_submodule_add(src_path, 'sub', cwd=parent_path)
     git_commit(cwd=parent_path)
 
     sub_pth = os.path.join(parent_path, 'sub')

tests/conftest.py

@@ -15,6 +15,7 @@
 from pre_commit.util import cmd_output
 from pre_commit.util import make_executable
 from testing.fixtures import git_dir
+from testing.fixtures import git_submodule_add
 from testing.fixtures import make_consuming_repo
 from testing.fixtures import write_config
 from testing.util import cwd
@@ -90,7 +91,7 @@ def in_conflicting_submodule(tempdir_factory):
     git_dir_1 = git_dir(tempdir_factory)
     git_dir_2 = git_dir(tempdir_factory)
     git_commit(msg=in_conflicting_submodule.__name__, cwd=git_dir_2)
-    cmd_output('git', 'submodule', 'add', git_dir_2, 'sub', cwd=git_dir_1)
+    git_submodule_add(git_dir_2, 'sub', cwd=git_dir_1)
     with cwd(os.path.join(git_dir_1, 'sub')):
         _make_conflict()
         yield

tests/repository_test.py

@@ -2,6 +2,7 @@
 
 import os.path
 import shutil
+import subprocess
 from typing import Any
 from unittest import mock
 
@@ -22,11 +23,13 @@
 from pre_commit.languages import ruby
 from pre_commit.languages import rust
 from pre_commit.languages.all import languages
+from pre_commit.parse_shebang import find_executable
 from pre_commit.prefix import Prefix
 from pre_commit.repository import all_hooks
 from pre_commit.repository import install_hook_envs
 from pre_commit.util import cmd_output
 from pre_commit.util import cmd_output_b
+from testing.fixtures import git_submodule_add
 from testing.fixtures import make_config_from_repo
 from testing.fixtures import make_repo
 from testing.fixtures import modify_manifest
@@ -400,6 +403,20 @@ def test_golang_hook_still_works_when_gobin_is_set(tempdir_factory, store):
     assert os.listdir(gobin_dir) == []
 
 
+@pytest.fixture
+def allow_file_submodules():
+    git_exe = find_executable('git')
+
+    def new(cmd, *args, orig=subprocess.Popen, **kwargs):
+        if cmd[0] == git_exe:
+            cmd = (git_exe, '-c', 'protocol.file.allow=always', *cmd[1:])
+        return orig(cmd, *args, **kwargs)
+
+    with mock.patch.object(subprocess, 'Popen', new):
+        yield
+
+
+@pytest.mark.usefixtures('allow_file_submodules')
 def test_golang_with_recursive_submodule(tmpdir, tempdir_factory, store):
     sub_go = '''\
 package sub
@@ -443,7 +460,7 @@ def test_golang_with_recursive_submodule(tmpdir, tempdir_factory, store):
     repo.join('main.go').write(main_go)
     cmd_output('git', '-C', str(repo), 'init', '.')
     cmd_output('git', '-C', str(repo), 'add', '.')
-    cmd_output('git', '-C', str(repo), 'submodule', 'add', str(sub), 'sub')
+    git_submodule_add(sub, 'sub', cwd=repo)
     git.commit(str(repo))
 
     config = make_config_from_repo(str(repo))

tests/staged_files_only_test.py

@@ -11,6 +11,7 @@
 from pre_commit.util import cmd_output
 from testing.auto_namedtuple import auto_namedtuple
 from testing.fixtures import git_dir
+from testing.fixtures import git_submodule_add
 from testing.util import cwd
 from testing.util import get_resource_path
 from testing.util import git_commit
@@ -206,9 +207,7 @@ def sub_staged(repo_with_commits, tempdir_factory):
         open('bar', 'a+').close()
         cmd_output('git', 'add', 'bar')
         git_commit()
-        cmd_output(
-            'git', 'submodule', 'add', repo_with_commits.path, 'sub',
-        )
+        git_submodule_add(repo_with_commits.path, 'sub')
         checkout_submodule(repo_with_commits.rev1)
         cmd_output('git', 'add', 'sub')
         yield auto_namedtuple(