GitHub Security Advisory: GHSA-m8rp-vv92-46c7
Package: gix-path (RUST)
Severity: MODERATE (CVSS 6.0)
CWE: CWE-41: Improper Resolution of Path Equivalence
Vulnerable versions: <= 0.10.10
Patched in: 0.10.11

Summary: gix-path improperly resolves configuration path reported by Git

Details:
### Summary

`gix-path` runs `git` to find the path of a configuration file associated with the `git` installation, but improperly resolves paths containing unusual or non-ASCII characters, in rare cases enabling a local attacker to inject configuration leading to code execution.

### Details

In `gix_path::env`, the underlying implementation of the `installation_config` and `installation_config_prefix` functions calls `git config -l --show-origin` to find the path of a file to treat as belonging to the `git` installation.

Affected versions of `gix-path` do not pass `-z`/`--null` to cause `git` to report literal paths ([`650a1b5`](https://github.com/Byron/gitoxide/commit/650a1b5cf25e086197cc55a68525a411e1c28031)). Instead, to cover the occasional case that `git` outputs a quoted path, they attempt to parse the path by stripping the quotation marks:

https://github.com/Byron/gitoxide/blob/1cfe577d461293879e91538dbc4bbfe01722e1e8/gix-path/src/env/git/mod.rs#L138-L142

The problem is that, when a path is quoted, it may change in substantial ways beyond the concatenation of quotation marks. If not reversed, these changes can result in another valid path that is not equivalent to the original.

This is not limited to paths with unusual characters such as quotation marks or newlines. Unless `git` is explicitly configured with `core.quotePath` set to `false`, it also happens when the path contains most non-ASCII characters, including accented or non-English letters. For example, `é` is transformed to `\303\251`, with literal backslashes. (This is an octal representation of the bytes in its UTF-8 encoding. This behavior is not limited to systems that encode paths with UTF-8 on disk.)

Rarely, the configuration file `gix-path` wrongly attempts to open can be created by an attacker who has a limited user account on the system. The attacker would often need to request an account username tailored to carrying out the attack.

### PoC

#### Quick demonstration on Unix

On a Unix-like system in which Git supports no higher scope than `system` for configuration variables (i.e., not on macOS with Apple Git), in a locale that supports UTF-8, with `gitoxide` installed, run:

```sh
mkdir myrepo
cd myrepo
git init
printf '[real]\n\trealvar = realval\n' > 'é'
printf '[fake]\n\tfakevar = fakeval\n' > '\303\251'
GIT_CONFIG_SYSTEM='é' gix config
```

If the above conditions are satisfied and the `gix` command was built against an affected version of `gix-path`, then the last command's output looks something like this:

```text
# From '\303\251' (GitInstallation)
[fake]
        fakevar = fakeval

# From 'é' (System)
[real]
        realvar = realval

# From '/home/ubuntu/.gitconfig' (User)
[init]
        defaultBranch = main

# From './.git/config' (Local)
[core]
        repositoryformatversion = 0
        filemode = true
        bare = false
        logallrefupdates = true
 ```

#### Demonstration across user accounts on Windows

On a test system running Windows on whic