CVE-2025-10283: BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE

The vulnerability stems from insufficient sanitization of git repositories downloaded by bbot, specifically within the gitdumper.py and git_clone.py modules. The core of the issue was in the GitDumper.sanitize_config function, which attempted to neutralize malicious entries in a .git/config file using a regex blacklist. This approach was inadequate and could be bypassed, allowing for Remote Code Execution (RCE) through specially crafted git configurations.

The vulnerability also involved the handling of the .git/index file, which could be manipulated to cause an arbitrary file write, also leading to RCE. The patch addresses these issues by removing the flawed sanitize_config function entirely and introducing a new, more robust sanitization function, sanitize_git_repo. This new function doesn't try to parse the git files; instead, it defensively renames the .git/config, .git/index, and .git/hooks directory, effectively neutralizing any potential threats before any git commands that might interpret them (like git checkout) are executed. The vulnerable functions are those that were part of the workflow that handled the unsanitized repository, including the function that performed the insufficient sanitization (sanitize_config), the function that called it (handle_event), and the functions that operated on the repository (git_checkout, clone_git_repository).