Git 存储库的文件名中是否禁止使用 ɴᴜʟ 字符？

Question

Without considering any implementation behaviour or host ᴏꜱ, are there by design, characters which aren't allowed in file or directory names?

I'm especially interested (considering Git is sometimes used as front-end) if the ᴀꜱᴄɪɪ ɴᴜʟ character is allowed.
If this isn't allowed, can the attempt to create such file with rugged lead to remote code execution ?

Answer 1

Yes. The index and tree objects both impose limitations due to their design:

1. A NUL cannot be in a path name. git uses null terminated strings to store filenames internally, both in the index and in tree objects .

2. A / cannot be in a filename, as it is the path separator in the index.

There are additional limitations imposed by Git clients, which are not part of the design of the data file formats:

3. A path component cannot be named .git .

4. A path component may not be named . or .. , to prevent you from escaping your working directory.

5. If core.protectHFS is set, then when all zero-width Unicode characters are removed from a path component, the remainder may not be .git .

6. If core.protectNTFS is set, then a path component may not be GIT~1 , .git\\ or .git followed by trailing spaces or dots.

And no, you cannot create those with libgit2 either, because it also uses null terminated strings to store paths. It seems unlikely that there's a buffer overrun potential here (if anything, you would expect a buffer underrun).