Subdirectories can't have name .jj? (reserved path component)

[heygarrett]

I tried to clone Prettier, but got an error:

~/d/repos/forks
❯ jj git clone [email protected]:prettier/prettier.git
Fetching into new repo in "/Users/garrett/dev/repos/forks/prettier"
bookmark: dependabot/npm_and_yarn/website/undici-6.21.1@origin [new] untracked
bookmark: dont-merge@origin                                    [new] untracked
bookmark: feat-let-syntax@origin                               [new] untracked
bookmark: fix-16398@origin                                     [new] untracked
bookmark: main@origin                                          [new] untracked
bookmark: next@origin                                          [new] untracked
bookmark: release-blog-3.5@origin                              [new] untracked
bookmark: remark-11@origin                                     [new] untracked
[...]
tag:    4.0.0-alpha.7                                        [new]
tag:    4.0.0-alpha.8                                        [new]
tag:    4.0.0-alpha.9                                        [new]
Setting the revset alias "trunk()" to "main@origin"
Internal error: Failed to check out commit b42f1de712acae040357b86b2dbc077478de011d
Caused by: Reserved path component .jj in /Users/garrett/dev/repos/forks/prettier/tests/integration/cli/ignore-vcs-files/.jj

It turns out that the repo has a subdirectory with the name .jj which was added as part of a change to better support using Prettier in Jutusu-versioned repos. I tried to open an issue, but perhaps I didn't clarify the issue well enough because it got immediately closed.

Regardless of whether it's something that's addressed in the Prettier repo, is it not possible to support subdirectories with the name .jj? I figure only the root .jj would be relevant to actually using Jujutsu.

[ilyagr]

This seems dangerous. If you have something/.jj, and run jj from the something dir, there'd be no way for jj to know that something/.jj is not the "actual" .jj and that it's supposed to look at .jj from the parent dir.

A malicious repo could also try to intentionally confuse jj and set up something/.jj/config.toml to do something malicious.

[heygarrett]

Thanks for the explanation! Not something I'd thought of. 😅

[yuja]

Directory named .jj and .git are banned for security reasons. If these directories were checked out, jj may read config file from there, which may contain malicious content. Maybe you can set sparse pattern to exclude these files (but I haven't tried if that works.)

[heygarrett]

I hadn't thought to try a sparse checkout. Though the issue in the Prettier repo has been re-opened, so hopefully it's something that can be addressed over there.

[ilyagr]

...and if you do find a way to get jj to use (write to disk) the something/.jj from an external repo, that would be considered quite serious, and please let us know via https://github.com/jj-vcs/jj/security .