fix(backend): opt in to simple-git unsafe categories present in env

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Added warning message that fires on startup when host environment contains env vars that simple-git flags as unsafe. [#1193](https://github.com/sourcebot-dev/sourcebot/pull/1193)
+
 ### Fixed
 - Add missing schema changes introduced in [#1170](https://github.com/sourcebot-dev/sourcebot/pull/1170). [#1176](https://github.com/sourcebot-dev/sourcebot/pull/1176)
 - Fixed blame gutter commit navigation to use the file path as it existed at the attributing commit, so clicking a blame line whose commit predates a rename resolves to the correct historical path. [#1178](https://github.com/sourcebot-dev/sourcebot/pull/1178)

packages/backend/src/git.ts

@@ -3,11 +3,33 @@ import { existsSync } from 'node:fs';
 import { mkdir } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 import { CheckRepoActions, GitConfigScope, simpleGit, SimpleGitProgressEvent } from 'simple-git';
+import { parseEnv } from '@simple-git/argv-parser';
 
 type onProgressFn = (event: SimpleGitProgressEvent) => void;
 
 const logger = createLogger('git-utils');
 
+/**
+ * simple-git blocks certain env vars (e.g., GIT_SSH_COMMAND, GIT_ASKPASS, etc.)
+ * by default to prevent common git vulnerabilities by throwing a exception. To
+ * maintain backwards compatibility, we opt to permit these env vars but raise a
+ * warning message s.t., system admins are aware.
+ * 
+ * @see https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md
+ */
+const { vulnerabilities: envVulnerabilities } = parseEnv(process.env);
+const unsafe = Object.fromEntries(
+    envVulnerabilities.map(v => [v.category, true] as const)
+);
+
+if (envVulnerabilities.length > 0) {
+    const details = envVulnerabilities.map(v => `  - ${v.category}: ${v.message}`).join('\n');
+    logger.warn(
+        `Opting in to unsafe simple-git categories based on inherited environment:\n${details}\n` +
+        `See https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md`
+    );
+}
+
 /**
  * Creates a simple-git client that has it's working directory
  * set to the given path.
@@ -22,6 +44,7 @@ const createGitClientForPath = (path: string, onProgress?: onProgressFn, signal?
     const git = simpleGit({
         progress: onProgress,
         abort: signal,
+        unsafe,
     })
         .env({
             ...process.env,