GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — fix: preserve literal clone URLs by Byron · Pull Request #2172 · gitpython-developers/GitPython

Conversation

Byron commented Jul 15, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

refackiew

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Summary

Preserve caller-provided clone URLs literally when invoking Git and when storing the resulting origin URL. Validate unsafe protocols against the exact normalized value passed to Git. Legacy expansion remains available to callers that intentionally normalize local paths.

Security advisory

Advisory: GHSA-rwj8-pgh3-r573
GHSA: GHSA-rwj8-pgh3-r573

Advisory summary

Severity: High
Package: gitpython (pip)
Affected range: <= 3.1.50
Patched version: not yet assigned
CVE: not yet assigned

The advisory remains a draft, so this description intentionally omits exploit details.

Validation

pytest test/test_clone.py -q — 20 passed, 1 skipped
ruff check on changed files — passed
ruff format --check on changed files — passed
Full pytest -q — 681 passed, 73 skipped, 1 xfailed; 7 unrelated local environment/baseline failures (including tests that assume a master default branch and local daemon/config behavior)

Git behavior reference

Git passes clone URL arguments through literally; t/t5601-clone.sh exercises accepted clone URL forms without shell-style environment expansion.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Byron force-pushed the fix-clone-expandvars branch 2 times, most recently from 4db3773 to 6575026 Compare

July 15, 2026 15:03


          fix: prevent environment expansion in clone URLs

8ac5a30

Repo.clone_from() expanded environment-variable references in caller-supplied
URLs before passing them to git clone. This could expose process environment
values to an untrusted remote and made protocol validation apply to a different
value than Git received.

Polish clone URLs without variable or home expansion on native and Cygwin
Git, then apply unsafe-protocol validation to that exact normalized value.
Preserve the literal URL when normalizing the stored origin after a successful
clone, while retaining the existing Git.polish_url() default for callers
that intentionally normalize local paths. Add regression coverage for
POSIX and Windows variable syntax, Cygwin conversion, stored origins, and
post-normalization protocol validation.

Git baseline: git clone passes URL arguments through literally; t/t5601-clone.sh
covers the accepted URL forms without shell-style environment expansion.

Security: GHSA-rwj8-pgh3-r573.

Co-authored-by: Sebastian Thiel <[email protected]>

Byron force-pushed the fix-clone-expandvars branch from 6575026 to 8ac5a30 Compare

July 16, 2026 02:53

Byron marked this pull request as ready for review

July 16, 2026 02:53

Copilot AI review requested due to automatic review settings

July 16, 2026 02:53

Copilot started reviewing on behalf of Byron

July 16, 2026 02:56

View session

Copilot AI reviewed

Jul 16, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens Repo.clone_from URL handling by preventing environment/~ expansion for clone URLs and for the stored origin URL, aligning GitPython behavior with Git’s literal argument handling and supporting the referenced security advisory.

Changes:

Add an expand_vars switch to Git.polish_url and propagate it through cygpath/_cygexpath.
In Repo._clone, use a literal (non-expanding) polished URL for unsafe-protocol validation and for the git clone invocation; also avoid expansion when persisting remote.origin.url.
Add regression tests ensuring clone URLs and stored origin URLs preserve environment-variable-like substrings literally.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
test/test_clone.py	Adds tests asserting clone URLs and stored origin URLs are not environment-expanded; adds protocol-check regression coverage.
git/util.py	Adds `expand_vars` control to `cygpath` and `_cygexpath` to support non-expanding URL polishing on Cygwin.
git/repo/base.py	Switches clone URL handling to non-expanding polishing and checks unsafe protocols against the exact value passed to Git; stores origin URL without expansion.
git/cmd.py	Extends `Git.polish_url` with `expand_vars` (docs + behavior) and uses it to disable env/`~` expansion when requested.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

test/test_clone.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Byron merged commit c65dfb3 into main

Jul 16, 2026

31 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Byron deleted the fix-clone-expandvars branch

July 16, 2026 03:04

renovate Bot mentioned this pull request

Jul 24, 2026

chore(deps): update dependency gitpython to v3.1.55 [security] - autoclosed echoix/megalinter#347

Closed

it-integrations mentioned this pull request

Aug 6, 2026

🟠 [High] GitPython: Environment-Variable Exfiltration via os.path.expandvars() on Repo.clone_from() URL Latch/connectedhomeip#39

Open

736-c41-2c1-e464fc974 pushed a commit to Swiss-Armed-Forces/Loom that referenced this pull request

Aug 16, 2026


          chore(deps): update dependency gitpython to v3.1.52

c1b7b14

This MR contains the following updates:

| Package | Type | Update | Change | OpenSSF |
|---|---|---|---|---|
| [gitpython](https://github.com/gitpython-developers/GitPython) | dev | patch | `3.1.50` → `3.1.52` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/gitpython-developers/GitPython/badge)](https://securityscorecards.dev/viewer/?uri=github.com/gitpython-developers/GitPython) |

---

### Release Notes

<details>
<summary>gitpython-developers/GitPython (gitpython)</summary>

### [`v3.1.52`](https://github.com/gitpython-developers/GitPython/releases/tag/3.1.52): Security

[Compare Source](gitpython-developers/GitPython@3.1.51...3.1.52)

<GHSA-rwj8-pgh3-r573>: Environment-variable exfiltration via os.path.expandvars() on Repo.clone\_from() URL

#### What's Changed

- Skip cross-drive relative config test on Windows by [@&#8203;Byron](https://github.com/Byron) in [#&#8203;2171](gitpython-developers/GitPython#2171)
- fix: preserve literal clone URLs by [@&#8203;Byron](https://github.com/Byron) in [#&#8203;2172](gitpython-developers/GitPython#2172)

**Full Changelog**: <gitpython-developers/GitPython@3.1.51...3.1.52>

### [`v3.1.51`](https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51): - Security

[Compare Source](gitpython-developers/GitPython@3.1.50...3.1.51)

#### What's Changed

- Add AI-disclosure and quality requirements to the contribution guidelines by [@&#8203;Byron](https://github.com/Byron) in [#&#8203;2143](gitpython-developers/GitPython#2143)
- docs(cmd): clarify Git.execute() string vs list command argument by [@&#8203;mvanhorn](https://github.com/mvanhorn) in [#&#8203;2144](gitpython-developers/GitPython#2144)
- Rewrite Git.execute() command parameter docstring per [#&#8203;2146](gitpython-developers/GitPython#2146) by [@&#8203;EliahKagan](https://github.com/EliahKagan) in [#&#8203;2147](gitpython-developers/GitPython#2147)
- Document init script behavior with multiple master remotes by [@&#8203;EliahKagan](https://github.com/EliahKagan) in [#&#8203;2148](gitpython-developers/GitPython#2148)
- Bump git/ext/gitdb from `335c0f6` to `0a019a2` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2149](gitpython-developers/GitPython#2149)
- Support relative worktree paths (git 2.48+ worktree.useRelativePaths) by [@&#8203;elovelan](https://github.com/elovelan) in [#&#8203;2151](gitpython-developers/GitPython#2151)
- Defer xfail condition evaluation with xfail\_if\_raises context manager by [@&#8203;elovelan](https://github.com/elovelan) in [#&#8203;2153](gitpython-developers/GitPython#2153)
- Run more submodule tests on Cygwin (fix flaky xfails) by [@&#8203;EliahKagan](https://github.com/EliahKagan) in [#&#8203;2154](gitpython-developers/GitPython#2154)
- Cut xtrace noise from POSIX-ownership diagnostic steps by [@&#8203;EliahKagan](https://github.com/EliahKagan) in [#&#8203;2156](gitpython-developers/GitPython#2156)
- Support index diffs against the empty tree by [@&#8203;puneetdixit200](https://github.com/puneetdixit200) in [#&#8203;2155](gitpython-developers/GitPython#2155)
- refactor: seperate out Progress type by [@&#8203;LoeschMaximilian](https://github.com/LoeschMaximilian) in [#&#8203;2157](gitpython-developers/GitPython#2157)
- Bump <https://github.com/astral-sh/ruff-pre-commit> from v0.15.12 to 0.15.15 in the pre-commit group by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2160](gitpython-developers/GitPython#2160)
- Bump actions/checkout from 6 to 7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2164](gitpython-developers/GitPython#2164)
- Bump git/ext/gitdb from `0a019a2` to `4950ea9` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2165](gitpython-developers/GitPython#2165)
- Bump <https://github.com/astral-sh/ruff-pre-commit> from v0.15.15 to 0.15.20 in the pre-commit group by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2166](gitpython-developers/GitPython#2166)
- Add Commit.is\_shallow property; document stats() limitation at shallow boundary by [@&#8203;harshitayadavv](https://github.com/harshitayadavv) in [#&#8203;2167](gitpython-developers/GitPython#2167)
- Allow relative config paths with includes by [@&#8203;Byron](https://github.com/Byron) in [#&#8203;2169](gitpython-developers/GitPython#2169)
- Reject abbreviated forms of unsafe git options by [@&#8203;Byron](https://github.com/Byron) in [#&#8203;2168](gitpython-developers/GitPython#2168)
- guard unsafe git command options by [@&#8203;Byron](https://github.com/Byron) in [#&#8203;2163](gitpython-developers/GitPython#2163)

#### New Contributors

- [@&#8203;elovelan](https://github.com/elovelan) made their first contribution in [#&#8203;2151](gitpython-developers/GitPython#2151)
- [@&#8203;puneetdixit200](https://github.com/puneetdixit200) made their first contribution in [#&#8203;2155](gitpython-developers/GitPython#2155)
- [@&#8203;LoeschMaximilian](https://github.com/LoeschMaximilian) made their first contribution in [#&#8203;2157](gitpython-developers/GitPython#2157)
- [@&#8203;harshitayadavv](https://github.com/harshitayadavv) made their first contribution in [#&#8203;2167](gitpython-developers/GitPython#2167)

**Full Changelog**: <gitpython-developers/GitPython@3.1.50...3.1.51>

</details>

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI3MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZSJdfQ==-->

See merge request swiss-armed-forces/cyber-command/cea/loom!679

Co-authored-by: Loom MR Pipeline Trigger <group_103951964_bot_9504bb8dead6d4e406ad817a607f24be@noreply.gitlab.com>

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

Byron commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tasks

Summary

Security advisory

Advisory summary

Validation

Git behavior reference

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Byron commented Jul 15, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.