gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()

Summary In the gix crate, Cache::protectoptions() in gix/src/config/cache/access.rs reads the three filesystem path-protection settings (core.protectHFS, core.protectNTFS, and gitoxide.core.protectWindows) with the unfiltered gixconfig::File::boolean() accessor instead of the trust-aware booleanfilter() accessor used by every other security-critical config read in the same file. When a repository is opened with reduced trust (an ownership mismatch, which maps .git/config sections to Trust::Reduced), these protection settings should not be honored from the untrusted repository-local config. Because the trust filter is skipped, an attacker who controls a repository's .git/config on a shared filesystem can set core.protectNTFS = false and/or core.protectHFS = false, disabling the .git path-confusion checks that run during checkout, index creation, merge, and tree editing. On case-insensitive filesystems this lets crafted tree entries resolve to the .git directory and overwrite hooks or config. Root Cause Repositories opened under Trust::Reduced install a section filter (istrusted) so that security-relevant settings coming from an untrusted repository-local .git/config are ignored.…

curl https://cve.zerocrew.in/api/cve/GHSA-q54r-jf2p-rfr2