Workaround to allow using local git submodules in tests (#3633)

diff --git a/test/lish/archives_and_uploads_a_package_test.dart b/test/lish/archives_and_uploads_a_package_test.dart
index da7fdf7..9cb4146 100644
--- a/test/lish/archives_and_uploads_a_package_test.dart
+++ b/test/lish/archives_and_uploads_a_package_test.dart
@@ -102,7 +102,16 @@
     var repo = d.git(appPath, d.validPackage.contents);
     await repo.create();
 
-    await repo.runGit(['submodule', 'add', '../empty', 'empty']);
+    await repo.runGit([
+      // Hack to allow testing with local submodules after CVE-2022-39253.
+      '-c',
+      'protocol.file.allow=always',
+      'submodule',
+      'add',
+      '--',
+      '../empty',
+      'empty'
+    ]);
     await repo.commit();
 
     deleteEntry(p.join(d.sandbox, appPath, 'empty'));
diff --git a/test/package_list_files_test.dart b/test/package_list_files_test.dart
index 013f3a1..889d773 100644
--- a/test/package_list_files_test.dart
+++ b/test/package_list_files_test.dart
@@ -276,7 +276,14 @@
           d.file('file2.text', 'contents')
         ]).create();
 
-        await repo.runGit(['submodule', 'add', '../submodule']);
+        await repo.runGit([
+          // Hack to allow testing with local submodules after CVE-2022-39253.
+          '-c',
+          'protocol.file.allow=always',
+          'submodule',
+          'add',
+          '../submodule'
+        ]);
 
         await d.file('$appPath/submodule/file1.txt', 'contents').create();