more fixes

oh-my-zsh.sh

@@ -122,7 +122,9 @@ _omz_git_head() {
   # .git may be a file pointing at the real git dir
   if [[ -f "$gitdir" ]]; then
     read -r head 2>/dev/null < "$gitdir" || return 1
+    [[ "$head" = "gitdir: "* ]] || return 1
     gitdir="${head#gitdir: }"
+    [[ -n "$gitdir" ]] || return 1
     [[ "$gitdir" = /* ]] || gitdir="$ZSH/$gitdir"
   fi
 
@@ -138,14 +140,39 @@ _omz_git_head() {
 
   if [[ "$head" = ref:\ * ]]; then
     ref="${head#ref: }"
-    if [[ -r "$common/$ref" ]]; then
-      read -r REPLY 2>/dev/null < "$common/$ref" || return 1
-    elif [[ -r "$common/packed-refs" ]]; then
-      lines=("${(@f)$(<"$common/packed-refs")}")
-      REPLY="${lines[(r)* ${(b)ref}]%% *}"
-    else
-      return 1
-    fi
+
+    # Only use well-formed full ref names as paths. Besides matching Git's ref
+    # rules, this prevents a malformed HEAD from escaping the git directory.
+    [[ "$ref" = refs/?* \
+      && "$ref" != *..* \
+      && "$ref" != *//* \
+      && "$ref" != */ \
+      && "$ref" != */.* \
+      && "$ref" != *.lock \
+      && "$ref" != *.lock/* \
+      && "$ref" != *. \
+      && "$ref" != *'@{'* \
+      && "$ref" != *[[:cntrl:]\ \~\^\:\?\*\[\\]* \
+    ]] || return 1
+
+    case "$ref" in
+      # These namespaces are private to each worktree and are never resolved
+      # from the common directory or its packed-refs file.
+      refs/bisect/*|refs/worktree/*|refs/rewritten/*)
+        [[ -r "$gitdir/$ref" ]] || return 1
+        read -r REPLY 2>/dev/null < "$gitdir/$ref" || return 1
+        ;;
+      *)
+        if [[ -r "$common/$ref" ]]; then
+          read -r REPLY 2>/dev/null < "$common/$ref" || return 1
+        elif [[ -r "$common/packed-refs" ]]; then
+          lines=("${(@f)$(<"$common/packed-refs")}")
+          REPLY="${lines[(r)* ${(b)ref}]%% *}"
+        else
+          return 1
+        fi
+        ;;
+    esac
   else
     # detached HEAD: the file holds the commit itself
     REPLY="$head"