Skip to content

Reject abbreviated forms of unsafe git options - #2168

Merged
Byron merged 3 commits into
mainfrom
advisory-fix-1
Jul 12, 2026
Merged

Reject abbreviated forms of unsafe git options#2168
Byron merged 3 commits into
mainfrom
advisory-fix-1

Conversation

@Byron

@ByronByron commented Jul 12, 2026

Copy link
Copy Markdown
Member

What

check_unsafe_options only matched exact canonical names, so an abbreviated option like --upl slipped past the guard and reached git as --upload-pack — arbitrary command execution even with allow_unsafe_options=False.

Fix

Reject an option when its canonical name is a prefix of any blocked option's name. Empty candidates (e.g. a bare --) are skipped so they don't false-match.

Test

Added a clone-path regression test covering --upl, --upload-pac, and --conf. Existing unsafe-option tests still pass.

Refers: GHSA-f2m5-q89v-8m67.

CopilotAI review requested due to automatic review settings July 12, 2026 09:22
CopilotAI reviewed Jul 12, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR strengthens GitPython’s unsafe-option guard (Git.check_unsafe_options) to also reject abbreviated long options (e.g. --upl for --upload-pack) and adds a clone regression test to cover abbreviated spellings that Git accepts.

Changes:

  • Updated Git.check_unsafe_options to treat any unambiguous long-option prefix of a blocked option as unsafe.
  • Added a clone regression test for abbreviated unsafe options (--upl, --upload-pac, --conf).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

FileDescription
git/cmd.pyExtends unsafe-option detection to include long-option prefix abbreviations.
test/test_clone.pyAdds regression coverage for abbreviated unsafe clone options.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment threadgit/cmd.py
Comment threadtest/test_clone.py
CopilotAI review requested due to automatic review settings July 12, 2026 11:45
CopilotAI reviewed Jul 12, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comment threadgit/cmd.py Outdated
CopilotAI review requested due to automatic review settings July 12, 2026 11:53
@Byron
Byronforce-pushed the advisory-fix-1 branch 2 times, most recently from 5ed4f88 to 25c684bCompareJuly 12, 2026 11:53
CopilotAI reviewed Jul 12, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comment threadgit/cmd.py
CopilotAI review requested due to automatic review settings July 12, 2026 12:12
CopilotAI reviewed Jul 12, 2026

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@Byron
Byron requested a review from CopilotJuly 12, 2026 12:15
CopilotAI reviewed Jul 12, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Comment threadgit/cmd.py
CopilotAI review requested due to automatic review settings July 12, 2026 12:24
@Byron
Byronforce-pushed the advisory-fix-1 branch 2 times, most recently from 0f9720e to 8b53090CompareJuly 12, 2026 12:25
@ByronByron mentioned this pull request Jul 12, 2026
Closed
1 task
codex added 2 commits July 12, 2026 14:27
@codex@Byron
Address review feedback about unsafe option abbreviations
181e8ed
The prefix check could reject otherwise allowed one-letter short options when an unrelated blocked long option began with the same character. Keep exact matches for every spelling, but restrict prefix matching to explicit long options and multi-character kwargs.
This addresses the review comment: single-letter short options and kwargs must not be treated as long-option abbreviations. It also adds coverage for abbreviated unsafe kwargs so both clone validation paths remain protected.
Reviewd-by: Sebastian Thiel <sebastian.thiel@icloud.com>
@codex@Byron
fix: reject joined unsafe short options
5680608
GitPython blocks options such as --upload-pack/-u and --config/-c
because they can execute arbitrary commands unless unsafe options are
explicitly allowed. Git also accepts a short option with its value
joined to the same token, including after clusterable flags. Forms
such as -uVALUE, -fuVALUE, -cVALUE, and -vcVALUE could therefore
bypass an exact-token check.
Parse single-dash option tokens sufficiently to recognize blocked
short options while preserving safe attached values such as
-oupstream. Also distinguish clone multi-option values from bare
kwargs so positional values are not treated as long-option
abbreviations.
This completes the option-validation hardening for
GHSA-2f96-g7mh-g2hx.
Reviewed-by: Sebastian Thiel <sebastian.thiel@icloud.com>
CopilotAI reviewed Jul 12, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

@Byron
Byron merged commit 65a7283 into mainJul 12, 2026
59 checks passed
@Byron

Byron commented Jul 12, 2026

Copy link
Copy Markdown
MemberAuthor

Merging even without all CI green, as the runs that finish already show that it's probably working.
Will do follow-ups as needed once CI is back.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code reviewCopilotCopilot left review comments

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Byron@abhiprd2000@codex