Guard unsafe git init options

GHSA-9rj7-rf2p-w77r reports that Repo.init forwarded git-init
options without applying GitPython's unsafe-option policy. A regression
showed template and abbreviated option spellings reached Git without an
UnsafeOptionError and could create the destination before validation.

Add a git-init denylist for template installation and separate Git
directory redirection, check keyword options before any path or directory
mutation, and provide the standard explicit allow_unsafe_options escape
hatch. This preserves trusted uses while rejecting untrusted forwarding by
default.

An audit against Git cf5497b14c5a24f10c13f7e0ee85cb95af13ea6a
(v2.55.0.windows.3-16-gcf5497b14c) confirmed that init and clone are the
built-in commands that consume repository template directories. Clone,
clone_from, and submodule cloning already share the guarded clone helper;
the similarly named commit option only reads a commit-message template.

Validated with the focused init regression, the clone/init unsafe-option
suite, 185 config/Git/index/clone tests, Ruff, and basedpyright.

Author: codex

git/repo/base.py

@@ -142,6 +142,14 @@ class Repo:
     re_author_committer_start = re.compile(r"^(author|committer)")
     re_tab_full_line = re.compile(r"^\t(.*)$")
 
+    unsafe_git_init_options = [
+        # Can install hooks that execute during later Git commands:
+        "--template",
+        # Redirects the repository metadata to a caller-controlled path:
+        "--separate-git-dir",
+    ]
+    """Options to :manpage:`git-init(1)` that permit unsafe code execution or I/O."""
+
     unsafe_git_clone_options = [
         # Executes arbitrary commands:
         "--upload-pack",
@@ -1394,6 +1402,7 @@ def init(
         mkdir: bool = True,
         odbt: Type[GitCmdObjectDB] = GitCmdObjectDB,
         expand_vars: bool = True,
+        allow_unsafe_options: bool = False,
         **kwargs: Any,
     ) -> "Repo":
         """Initialize a git repository at the given path if specified.
@@ -1418,13 +1427,22 @@ def init(
             information disclosure, allowing attackers to access the contents of
             environment variables.
 
+        :param allow_unsafe_options:
+            Allow unsafe options to be used, such as ``--template`` and
+            ``--separate-git-dir``.
+
         :param kwargs:
             Keyword arguments serving as additional options to the
             :manpage:`git-init(1)` command.
 
         :return:
             :class:`Repo` (the newly created repo)
         """
+        if not allow_unsafe_options:
+            Git.check_unsafe_options(
+                options=Git._option_candidates([], kwargs),
+                unsafe_options=cls.unsafe_git_init_options,
+            )
         if path:
             path = expand_path(path, expand_vars)
         if mkdir and path and not osp.exists(path):

test/test_repo.py

@@ -82,6 +82,33 @@ def test_new_should_raise_on_invalid_repo_location(self):
         with tempfile.TemporaryDirectory() as tdir:
             self.assertRaises(InvalidGitRepositoryError, Repo, tdir)
 
+    def test_init_rejects_unsafe_options(self):
+        with tempfile.TemporaryDirectory() as tdir:
+            template_dir = osp.join(tdir, "template")
+            os.mkdir(template_dir)
+            unsafe_options = [
+                {"template": template_dir},
+                {"templa": template_dir},
+                {"separate_git_dir": osp.join(tdir, "git-dir")},
+                {"separate_git_di": osp.join(tdir, "git-dir")},
+            ]
+            for index, kwargs in enumerate(unsafe_options):
+                repo_dir = osp.join(tdir, f"repo-{index}")
+                with self.assertRaises(UnsafeOptionError):
+                    Repo.init(repo_dir, **kwargs)
+                assert not osp.exists(repo_dir)
+
+    def test_init_allows_explicitly_unsafe_options(self):
+        with tempfile.TemporaryDirectory() as tdir:
+            template_dir = osp.join(tdir, "template")
+            os.mkdir(template_dir)
+            repo = Repo.init(
+                osp.join(tdir, "repo"),
+                template=template_dir,
+                allow_unsafe_options=True,
+            )
+            assert repo.git_dir
+
     @with_rw_directory
     def test_new_should_raise_on_invalid_repo_location_within_repo(self, rw_dir):
         repo_dir = osp.join(rw_dir, "repo")