GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Reject abbreviated forms of unsafe git options by Byron · Pull Request #2168 · gitpython-developers/GitPython

Conversation

Byron commented Jul 12, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Tasks

refackiew

What

check_unsafe_options only matched exact canonical names, so an abbreviated option like --upl slipped past the guard and reached git as --upload-pack — arbitrary command execution even with allow_unsafe_options=False.

Fix

Reject an option when its canonical name is a prefix of any blocked option's name. Empty candidates (e.g. a bare --) are skipped so they don't false-match.

Test

Added a clone-path regression test covering --upl, --upload-pac, and --conf. Existing unsafe-option tests still pass.

Refers: GHSA-f2m5-q89v-8m67.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Reject abbreviated forms of unsafe git options

2ab0516

Copilot AI review requested due to automatic review settings

July 12, 2026 09:22

Copilot started reviewing on behalf of Byron

July 12, 2026 09:24

View session

Copilot AI reviewed

Jul 12, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR strengthens GitPython’s unsafe-option guard (Git.check_unsafe_options) to also reject abbreviated long options (e.g. --upl for --upload-pack) and adds a clone regression test to cover abbreviated spellings that Git accepts.

Changes:

Updated Git.check_unsafe_options to treat any unambiguous long-option prefix of a blocked option as unsafe.
Added a clone regression test for abbreviated unsafe options (--upl, --upload-pac, --conf).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`git/cmd.py`	Extends unsafe-option detection to include long-option prefix abbreviations.
`test/test_clone.py`	Adds regression coverage for abbreviated unsafe clone options.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

git/cmd.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

test/test_clone.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Copilot AI review requested due to automatic review settings

July 12, 2026 11:45

Copilot started reviewing on behalf of Byron

July 12, 2026 11:47

View session

Copilot AI reviewed

Jul 12, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

git/cmd.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Copilot AI review requested due to automatic review settings

July 12, 2026 11:53

Byron force-pushed the advisory-fix-1 branch 2 times, most recently from 5ed4f88 to 25c684b Compare

July 12, 2026 11:53

Copilot started reviewing on behalf of Byron

July 12, 2026 11:59

View session

Copilot AI reviewed

Jul 12, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

git/cmd.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Copilot AI review requested due to automatic review settings

July 12, 2026 12:12

Copilot AI reviewed

Jul 12, 2026

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Byron requested a review from Copilot

July 12, 2026 12:15

Copilot started reviewing on behalf of Byron

July 12, 2026 12:16

View session

Copilot AI reviewed

Jul 12, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

git/cmd.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Copilot AI review requested due to automatic review settings

July 12, 2026 12:24

Byron force-pushed the advisory-fix-1 branch 2 times, most recently from 0f9720e to 8b53090 Compare

July 12, 2026 12:25

Byron mentioned this pull request

Jul 12, 2026

fix: block unsafe long-option prefixes (GHSA-2f96-g7mh-g2hx) #2161

Closed

1 task done

codex added 2 commits

July 12, 2026 14:27


          Address review feedback about unsafe option abbreviations

181e8ed

The prefix check could reject otherwise allowed one-letter short options when an unrelated blocked long option began with the same character. Keep exact matches for every spelling, but restrict prefix matching to explicit long options and multi-character kwargs.

This addresses the review comment: single-letter short options and kwargs must not be treated as long-option abbreviations. It also adds coverage for abbreviated unsafe kwargs so both clone validation paths remain protected.

Reviewd-by: Sebastian Thiel <[email protected]>


          fix: reject joined unsafe short options

GitPython blocks options such as --upload-pack/-u and --config/-c
because they can execute arbitrary commands unless unsafe options are
explicitly allowed. Git also accepts a short option with its value
joined to the same token, including after clusterable flags. Forms
such as -uVALUE, -fuVALUE, -cVALUE, and -vcVALUE could therefore
bypass an exact-token check.

Parse single-dash option tokens sufficiently to recognize blocked
short options while preserving safe attached values such as
-oupstream. Also distinguish clone multi-option values from bare
kwargs so positional values are not treated as long-option
abbreviations.

This completes the option-validation hardening for
GHSA-2f96-g7mh-g2hx.

Reviewed-by: Sebastian Thiel <[email protected]>

Byron force-pushed the advisory-fix-1 branch from 8b53090 to 5680608 Compare

July 12, 2026 12:28

Copilot started reviewing on behalf of Byron

July 12, 2026 12:30

View session

Copilot AI reviewed

Jul 12, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Byron merged commit 65a7283 into main

Jul 12, 2026

59 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Byron commented Jul 12, 2026

Copy link

Copy Markdown

Member Author

Merging even without all CI green, as the runs that finish already show that it's probably working.
Will do follow-ups as needed once CI is back.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

736-c41-2c1-e464fc974 pushed a commit to Swiss-Armed-Forces/Loom that referenced this pull request

Aug 16, 2026


          chore(deps): update dependency gitpython to v3.1.52

c1b7b14

This MR contains the following updates:

| Package | Type | Update | Change | OpenSSF |
|---|---|---|---|---|
| [gitpython](https://github.com/gitpython-developers/GitPython) | dev | patch | `3.1.50` → `3.1.52` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/gitpython-developers/GitPython/badge)](https://securityscorecards.dev/viewer/?uri=github.com/gitpython-developers/GitPython) |

---

### Release Notes

<details>
<summary>gitpython-developers/GitPython (gitpython)</summary>

### [`v3.1.52`](https://github.com/gitpython-developers/GitPython/releases/tag/3.1.52): Security

[Compare Source](gitpython-developers/GitPython@3.1.51...3.1.52)

<GHSA-rwj8-pgh3-r573>: Environment-variable exfiltration via os.path.expandvars() on Repo.clone\_from() URL

#### What's Changed

- Skip cross-drive relative config test on Windows by [@&#8203;Byron](https://github.com/Byron) in [#&#8203;2171](gitpython-developers/GitPython#2171)
- fix: preserve literal clone URLs by [@&#8203;Byron](https://github.com/Byron) in [#&#8203;2172](gitpython-developers/GitPython#2172)

**Full Changelog**: <gitpython-developers/GitPython@3.1.51...3.1.52>

### [`v3.1.51`](https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51): - Security

[Compare Source](gitpython-developers/GitPython@3.1.50...3.1.51)

#### What's Changed

- Add AI-disclosure and quality requirements to the contribution guidelines by [@&#8203;Byron](https://github.com/Byron) in [#&#8203;2143](gitpython-developers/GitPython#2143)
- docs(cmd): clarify Git.execute() string vs list command argument by [@&#8203;mvanhorn](https://github.com/mvanhorn) in [#&#8203;2144](gitpython-developers/GitPython#2144)
- Rewrite Git.execute() command parameter docstring per [#&#8203;2146](gitpython-developers/GitPython#2146) by [@&#8203;EliahKagan](https://github.com/EliahKagan) in [#&#8203;2147](gitpython-developers/GitPython#2147)
- Document init script behavior with multiple master remotes by [@&#8203;EliahKagan](https://github.com/EliahKagan) in [#&#8203;2148](gitpython-developers/GitPython#2148)
- Bump git/ext/gitdb from `335c0f6` to `0a019a2` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2149](gitpython-developers/GitPython#2149)
- Support relative worktree paths (git 2.48+ worktree.useRelativePaths) by [@&#8203;elovelan](https://github.com/elovelan) in [#&#8203;2151](gitpython-developers/GitPython#2151)
- Defer xfail condition evaluation with xfail\_if\_raises context manager by [@&#8203;elovelan](https://github.com/elovelan) in [#&#8203;2153](gitpython-developers/GitPython#2153)
- Run more submodule tests on Cygwin (fix flaky xfails) by [@&#8203;EliahKagan](https://github.com/EliahKagan) in [#&#8203;2154](gitpython-developers/GitPython#2154)
- Cut xtrace noise from POSIX-ownership diagnostic steps by [@&#8203;EliahKagan](https://github.com/EliahKagan) in [#&#8203;2156](gitpython-developers/GitPython#2156)
- Support index diffs against the empty tree by [@&#8203;puneetdixit200](https://github.com/puneetdixit200) in [#&#8203;2155](gitpython-developers/GitPython#2155)
- refactor: seperate out Progress type by [@&#8203;LoeschMaximilian](https://github.com/LoeschMaximilian) in [#&#8203;2157](gitpython-developers/GitPython#2157)
- Bump <https://github.com/astral-sh/ruff-pre-commit> from v0.15.12 to 0.15.15 in the pre-commit group by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2160](gitpython-developers/GitPython#2160)
- Bump actions/checkout from 6 to 7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2164](gitpython-developers/GitPython#2164)
- Bump git/ext/gitdb from `0a019a2` to `4950ea9` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2165](gitpython-developers/GitPython#2165)
- Bump <https://github.com/astral-sh/ruff-pre-commit> from v0.15.15 to 0.15.20 in the pre-commit group by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2166](gitpython-developers/GitPython#2166)
- Add Commit.is\_shallow property; document stats() limitation at shallow boundary by [@&#8203;harshitayadavv](https://github.com/harshitayadavv) in [#&#8203;2167](gitpython-developers/GitPython#2167)
- Allow relative config paths with includes by [@&#8203;Byron](https://github.com/Byron) in [#&#8203;2169](gitpython-developers/GitPython#2169)
- Reject abbreviated forms of unsafe git options by [@&#8203;Byron](https://github.com/Byron) in [#&#8203;2168](gitpython-developers/GitPython#2168)
- guard unsafe git command options by [@&#8203;Byron](https://github.com/Byron) in [#&#8203;2163](gitpython-developers/GitPython#2163)

#### New Contributors

- [@&#8203;elovelan](https://github.com/elovelan) made their first contribution in [#&#8203;2151](gitpython-developers/GitPython#2151)
- [@&#8203;puneetdixit200](https://github.com/puneetdixit200) made their first contribution in [#&#8203;2155](gitpython-developers/GitPython#2155)
- [@&#8203;LoeschMaximilian](https://github.com/LoeschMaximilian) made their first contribution in [#&#8203;2157](gitpython-developers/GitPython#2157)
- [@&#8203;harshitayadavv](https://github.com/harshitayadavv) made their first contribution in [#&#8203;2167](gitpython-developers/GitPython#2167)

**Full Changelog**: <gitpython-developers/GitPython@3.1.50...3.1.51>

</details>

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI3MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZSJdfQ==-->

See merge request swiss-armed-forces/cyber-command/cea/loom!679

Co-authored-by: Loom MR Pipeline Trigger <group_103951964_bot_9504bb8dead6d4e406ad817a607f24be@noreply.gitlab.com>

hackkim commented Sep 2, 2026

Copy link

Copy Markdown

Hi @Byron,

Quick follow-up regarding GHSA-2f96-g7mh-g2hx. The advisory has been published, but it still shows “No known CVE.”

Since only maintainers/owners can request a CVE, would you mind requesting one for the advisory when you have a chance?

Thanks!

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Byron deleted the advisory-fix-1 branch

September 2, 2026 03:27

Byron commented Sep 2, 2026

Copy link

Copy Markdown

Member Author

I don't do this anymore for this class of issues.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

ECD5A mentioned this pull request

Sep 17, 2026

[GHSA-v396-v7q4-x2qj] Correct GitPython fix references github/advisory-database#8842

Open

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

Byron commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tasks

What

Fix

Test

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Byron commented Jul 12, 2026

Uh oh!

hackkim commented Sep 2, 2026

Uh oh!

Byron commented Sep 2, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

Byron commented Jul 12, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.