JGit repository-controlled child authority receives caller credentials #304

Version

JGit 7.9.0-SNAPSHOT (source revision 87ec2100083ffc894bedd1e3f0d76b7f10e45ed6)

Operating System

Linux/Unix

Bug description

I reproduced this on JGit source revision 87ec2100083ffc894bedd1e3f0d76b7f10e45ed6. JGit passes the outer CredentialsProvider into child submodule transports selected by repository metadata. In my testing environment, the same boundary is reached by:

1. recursive clone;
2. FetchCommand using the submodule path instead of its configured name for fetchRecurseSubmodules; and
3. a later fetch walking stale FETCH_HEAD.

To reproduce, set JGIT_DIR, JGIT_MAIN_JAR, and GIT_CORE_BIN to the pinned source/builds, then run ./attachments/reproduce.sh reproduce-output after extracting attachments.zip. GIT_CORE_BIN must report Git core 2.55.0.

Actual behavior

The child HTTP endpoint receives the caller's Basic credential after its 401 challenge. A URI-scoped provider records no authenticated child request. The Git core 2.55.0 controls record no credentialed child request. The per-case counts are in the attached log.

Expected behavior

A child transport selected by repository metadata should not inherit credentials for another authority. The child fetch policy should use the configured submodule name, and a no-op parent fetch should not activate a child from stale FETCH_HEAD.

Relevant log output

The redacted results are in `attachments/evidence.log`:


jgit_version=7.9.0-SNAPSHOT
jgit_source_revision=87ec2100083ffc894bedd1e3f0d76b7f10e45ed6
git_core_version=git version 2.55.0
case=recursive-clone
vulnerable_child_authorization=present
scoped_child_authorization=absent
native_child_authorization=absent
case=fetch-policy-name-path
jgit_child_requests=3
jgit_credentialed_child_requests=2
native_child_requests=0
case=stale-fetch-head
jgit_child_requests=3
jgit_credentialed_child_requests=2
native_first_child_requests=0
native_second_child_requests=0

Other information

report.md contains the source analysis and GitHub source links. attachments.zip contains the three minimal replay cases and redacted request evidence.

The report and reproduction were assisted by an LLM. I reviewed the source and confirmed the behavior by running the reproduction. Sorry if this adds review work; the attached details are intended to help locate and fix the issue.

Attachments

report.md

attachments.zip