gix-path uses local config across repos when it is the highest scope

Summary

gix-path executes git to find the path of a configuration file that belongs to the git installation itself, but mistakenly treats the local repository's configuration as system-wide if no higher scoped configuration is found. In rare cases, this causes a less trusted repository to be treated as more trusted, or leaks sensitive information from one repository to another, such as sending credentials to another repository's remote.

Details

In gix_path::env, the underlying implementation of the installation_config and installation_config_prefix functions calls git config -l --show-origin and parses the first line of the output to extract the path to the configuration file holding the configuration variable of highest scope:

While the configuration variable of highest scope is not usually in the local scope, there are practical situations where this occurs:

• A configuration file truly associated with the installation is not present on all systems and can occasionally be empty. Likewise, there may be no variables in the global scope.
• Configuration files associated with those higher scopes may be deliberately skipped by setting the GIT_CONFIG_SYSTEM and GIT_CONFIG_GLOBAL environment variables to /dev/null (or to NUL on Windows). This prevents gix-path from finding the path of configuration files for those scopes, while not preventing downstream components such as the function in `gix-config…