Skip to content

Commit d533b1c

Browse files
codexByron
authored andcommitted
fix: block joined short unsafe options (GHSA-v396-v7q4-x2qj)
1 parent 20c5e27 commit d533b1c

3 files changed

Lines changed: 10 additions & 1 deletion

File tree

git/cmd.py

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -957,7 +957,10 @@ def _canonicalize_option_name(cls, option: str) -> str:
957957
option_tokens = option_name.split(None, 1)
958958
if not option_tokens:
959959
return ""
960-
return dashify(option_tokens[0])
960+
option_token = option_tokens[0]
961+
if option.startswith("-") and not option.startswith("--") and len(option_token) > 1:
962+
option_token = option_token[:1]
963+
return dashify(option_token)
961964

962965
@classmethod
963966
def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:

test/test_clone.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,8 +118,10 @@ def test_clone_unsafe_options(self, rw_repo):
118118
unsafe_options = [
119119
f"--upload-pack='touch {tmp_file}'",
120120
f"-u 'touch {tmp_file}'",
121+
f"-u{tmp_file}",
121122
"--config=protocol.ext.allow=always",
122123
"-c protocol.ext.allow=always",
124+
f"-cprotocol.ext.allow=always",
123125
]
124126
for unsafe_option in unsafe_options:
125127
with self.assertRaises(UnsafeOptionError):
@@ -207,8 +209,10 @@ def test_clone_from_unsafe_options(self, rw_repo):
207209
unsafe_options = [
208210
f"--upload-pack='touch {tmp_file}'",
209211
f"-u 'touch {tmp_file}'",
212+
f"-u{tmp_file}",
210213
"--config=protocol.ext.allow=always",
211214
"-c protocol.ext.allow=always",
215+
f"-cprotocol.ext.allow=always",
212216
]
213217
for unsafe_option in unsafe_options:
214218
with self.assertRaises(UnsafeOptionError):

test/test_git.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,8 @@ def test_check_unsafe_options_normalizes_kwargs(self):
162162
(["exec"], ["--exec"]),
163163
(["u"], ["-u"]),
164164
(["c"], ["-c"]),
165+
(["-u/tmp/helper"], ["-u"]),
166+
(["-cprotocol.ext.allow=always"], ["-c"]),
165167
(["--upload-pack=/tmp/helper"], ["--upload-pack"]),
166168
(["--config core.filemode=false"], ["--config"]),
167169
]

0 commit comments

Comments
 (0)