Validate submodule names before creating module paths

Submodule names read from .gitmodules can become the separate Git directory path. Reject empty names, absolute or drive-qualified names, and parent components with either path separator at the shared path-construction boundary.

Add a local-repository regression test that demonstrates initialization cannot create a module repository outside the clone. This follows Git commit 0383bbb901 (submodule-config: verify submodule names as paths) while also accounting for os.path.join absolute-path semantics.

Advisory: GHSA-hmq2-w58f-27jc

Validation:
- pytest -q test/test_submodule.py (39 passed, 1 skipped, 1 xfailed)
- ruff check and format --check on changed files
- mypy git/objects/submodule/base.py

Author: codex

git/objects/submodule/base.py

@@ -6,6 +6,7 @@
 import gc
 from io import BytesIO
 import logging
+import ntpath
 import os
 import os.path as osp
 import stat
@@ -305,6 +306,13 @@ def _config_parser_constrained(self, read_only: bool) -> SectionConstraint:
     @classmethod
     def _module_abspath(cls, parent_repo: "Repo", path: PathLike, name: str) -> PathLike:
         if cls._need_gitfile_submodules(parent_repo.git):
+            if (
+                not name
+                or name.startswith(("/", "\\"))
+                or ntpath.splitdrive(name)[0]
+                or ".." in name.replace("\\", "/").split("/")
+            ):
+                raise ValueError("Invalid submodule name %r" % name)
             return osp.join(parent_repo.git_dir, "modules", name)
         if parent_repo.working_tree_dir:
             return osp.join(parent_repo.working_tree_dir, path)

test/test_submodule.py

@@ -925,6 +925,42 @@ def test_update_submodule_with_relative_path(self, rwdir):
 
         cloned_repo.submodule_update(init=True, recursive=True)
 
+    @with_rw_directory
+    @_patch_git_config("protocol.file.allow", "always")
+    def test_update_rejects_parent_component_in_name(self, rwdir):
+        source = git.Repo.init(osp.join(rwdir, "source"))
+        source.git.commit(m="initial commit", allow_empty=True)
+
+        parent = git.Repo.init(osp.join(rwdir, "parent"))
+        parent.git.submodule("add", source.working_tree_dir, "module")
+        parent.index.commit("add submodule")
+        modules_file = Path(parent.working_tree_dir) / ".gitmodules"
+        modules_file.write_text(
+            modules_file.read_text().replace('submodule "module"', 'submodule "../../../escaped/module"')
+        )
+        parent.index.add([".gitmodules"])
+        parent.index.commit("change submodule name")
+
+        clone = git.Repo.clone_from(parent.working_tree_dir, osp.join(rwdir, "clone"))
+        with pytest.raises(ValueError, match="submodule name"):
+            clone.submodules[0].update(init=True)
+        assert not osp.exists(osp.join(rwdir, "escaped"))
+        invalid_names = (
+            "",
+            "..",
+            "../module",
+            R"..\module",
+            "nested/../module",
+            R"nested\..\module",
+            "/module",
+            R"\module",
+            "C:module",
+            R"C:\module",
+        )
+        for name in invalid_names:
+            with pytest.raises(ValueError, match="submodule name"):
+                Submodule._module_abspath(clone, "module", name)
+
     @with_rw_directory
     @_patch_git_config("protocol.file.allow", "always")
     def test_list_only_valid_submodules(self, rwdir):