jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.

Affected: crates.io: jj-lib

### Impact

Specially crafted Git repositories can cause `jj` to write files outside the clone.

### Patches

Fixed in 0.23.0.

### Workarounds

Not much other than to not clone repositories from untrusted sources.

### References

Here's the original report from @joernchen:

> When cloning a crafted Git repository it is possible to let `jj` write > into arbitrary directories. This can be achieved by having file objects > which contain path traversals. > > Reproduction steps: > > Apply the following patch to Git version v.2.47.0: > > ```diff > diff --git a/path.c b/path.c > index 93491bab14..2f47e69fd1 100644 > --- a/path.c > +++ b/path.c > @@ -44,11 +44,11 @@ struct strbuf *get_pathname(void) > > static const char *cleanup_path(const char *path) > { > - /* Clean it up */ > + /* Clean it up > if (skip_prefix(path, "./", &path)) { > while (*path == '/') > path++; > - } > + }*/ > return path; > } > > @@ -1101,7 +1101,9 @@ int normalize_path_copy_len(char *dst, const char *src, int *prefix_len) > > int normalize_path_copy(char *dst, const char *src) > { > - return normalize_path_copy_len(dst, src, NULL); > +// return normalize_path_copy_len(dst, src, NULL); > + memcpy(dst, src, strlen(dst)); > + return 0; > } > > int strbuf_normalize_path(struct strbuf *src) > diff --git a/read-cache.c b/read-cache.c > index 3c078afadb..2eb44cb26f 100644 > --- a/read-cache.c > +++…

jujutsu-0.23.0-1.1 on GA media