fix(Git Node): Restore Clone and other operations on simple-git 3.36+ (#30223)

packages/nodes-base/nodes/Git/Git.node.ts

@@ -337,6 +337,10 @@ export class Git implements INodeType {
 				const gitOptions: Partial<SimpleGitOptions> = {
 					baseDir: resolvedRepositoryPath,
 					config: gitConfig,
+					// simple-git blocks callers from setting `core.hooksPath` via `config`
+					// unless this flag is set. We set it deliberately as a mitigation, so
+					// opt in to keep that mitigation working.
+					...(!enableHooks && { unsafe: { allowUnsafeHooksPath: true } }),
 				};
 
 				const git: SimpleGit = simpleGit(gitOptions)

packages/nodes-base/nodes/Git/__test__/Git.node.test.ts

@@ -130,6 +130,18 @@ describe('Git Node', () => {
 			);
 		});
 
+		it('should opt into allowUnsafeHooksPath when enableGitNodeHooks is false', async () => {
+			securityConfig.enableGitNodeHooks = false;
+
+			await gitNode.execute.call(executeFunctions);
+
+			expect(mockSimpleGit).toHaveBeenCalledWith(
+				expect.objectContaining({
+					unsafe: { allowUnsafeHooksPath: true },
+				}),
+			);
+		});
+
 		it('should not add core.hooksPath=/dev/null when enableGitNodeHooks is true', async () => {
 			securityConfig.enableGitNodeHooks = true;
 
@@ -141,6 +153,15 @@ describe('Git Node', () => {
 				}),
 			);
 		});
+
+		it('should not opt into allowUnsafeHooksPath when enableGitNodeHooks is true', async () => {
+			securityConfig.enableGitNodeHooks = true;
+
+			await gitNode.execute.call(executeFunctions);
+
+			const options = mockSimpleGit.mock.calls[0][0] as { unsafe?: unknown };
+			expect(options.unsafe).toBeUndefined();
+		});
 	});
 
 	describe('Restricted file paths', () => {