Test: Git - handling unsafe repositories

[lszomoru]

Refs: #157159

• windows @bpasero
• windows @gregvanl

Complexity: 3

Create Issue

---

git 2.35.2 has introduced a change in behaviour so that no git commands can be executed against a repository that is owned by a user other than the current user. This change is behaviour was a response to a potential security vulnerability. You can read more about it here - https://github.blog/2022-04-12-git-security-vulnerability-announced/#cve-2022-24765.

Pre-requisites

• Ensure that you have the latest version of Git for Windows installed.
• Ensure that you have the git.autoRepositoryDetection set to true.

Single repository

• Open a Windows Terminal as Administrator, and create a new folder called "scenario1"
• Inside the "scenario1" folder, run git clone https://github.com/microsoft/vscode.git
• Open a Windows Terminal as the current user, and navigate to "scenario1/vscode" folder
• Execute git status
  • Confirm that you are getting an error about dubious folder ownership
• Open VS Code Insiders, and open the "scenario1/vscode" folder
• Switch to the "Source Control" view
  • Confirm that a welcome view is shown and review the message for clarity.
• Click on the "Open Repository" button
  • Confirm that the repository is successfully opened

Multiple repositories

• Open a Windows Terminal as Administrator, and create a new folder called "scenario2"
• Inside the "scenario2" folder, run git clone https://github.com/microsoft/vscode.git vscode1
• Inside the "scenario2" folder, run git clone https://github.com/microsoft/vscode.git vscode2
• Open VS Code Insiders, and open the "scenario2" folder
• Switch to the "Source Control" view
  • Confirm that a welcome view is shown and review the message for clarity.
• Click on the "Open Repositories" button
  • Confirm that a quick pick opens listing both repositories
  • Click on "All Repositories" and confirm that both repositories are opened

Mixed repositories

• Open a Windows Terminal as Administrator, and create a new folder called "scenario3"
• Inside the "scenario3" folder, run git clone https://github.com/microsoft/vscode.git vscode1
• Open a Windows Terminal as the current user, and navigate to "scenario3" folder
• Inside the "scenario3" folder, run git clone https://github.com/microsoft/vscode.git vscode2
• Open VS Code Insiders, and open the "scenario3" folder
• Switch to the "Source Control" view
  • Confirm that the "vscode2" repository is opened
  • Confirm that a notification is shown for the "vscode1" repository
• Click the "Open Repository" button in the notification
  • Confirm that the "vscode1" repository is opened

[bpasero]

Nice steps 👍 . I once had a case where the SCM view would appear entirely empty, but was not able to reproduce later on.

[gregvanl]

Agree, very clear steps 👍
I do see the empty SCM view case for the mixed repository case