GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — fix: validate config section delimiters by Byron · Pull Request #2176 · gitpython-developers/GitPython

Conversation

Byron commented Jul 20, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

refackiew

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Advisory

GHSA-3rp5-jjmw-4wv2

Advisory summary

Severity: High
Package: gitpython (pip)
Affected versions: <= 3.1.52
Patched versions: Not yet assigned
CVE: Not yet assigned

Summary

Validate serialized configuration section boundaries at the shared writer entry points.
Reject unquoted closing section delimiters while preserving delimiters inside valid quoted subsections.
Cover plain and quoted-subsection-shaped unsafe inputs across the public writer APIs, plus a valid quoted-subsection compatibility case.

Git baseline

Compared with Git at a23bace963d508bd96983cc637131392d3face18: basic section parsing terminates on an unquoted closing bracket, while the extended form permits brackets inside quoted subsection text and requires a final bracket after the closing quote.

Validation

.venv/bin/pytest test/test_config.py -q — 32 passed, 1 known skip
.venv/bin/ruff check git/config.py test/test_config.py
.venv/bin/ruff format --check git/config.py test/test_config.py
git diff --check
Codex commit review completed; its compatibility finding was addressed and the refreshed commit passed review.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Byron force-pushed the fix-config-injection branch 2 times, most recently from e43d571 to ecd6844 Compare

July 20, 2026 09:35

Byron marked this pull request as ready for review

July 20, 2026 10:19

Copilot AI review requested due to automatic review settings

July 20, 2026 10:19

Copilot started reviewing on behalf of Byron

July 20, 2026 10:19

View session

Copilot AI reviewed

Jul 20, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request hardens Git config parsing and writing to better match Git’s own config grammar, with a focus on preventing malformed section delimiters (and related injection-style patterns) from being serialized via GitPython’s public config writer APIs.

Changes:

Replaces the config file reader with a Git-grammar state-machine parser and tightens accepted syntax.
Canonicalizes/validates section names at write time (including quoted subsections) and serializes values in a canonical escaped form.
Expands test coverage for invalid syntax, delimiter-injection attempts, and writer round-trips (including quoted subsections and escape sequences).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

File	Description
`git/config.py`	Implements Git-grammar parsing, canonical section validation, and canonical escaping for config writes.
`test/test_config.py`	Adds/updates tests covering Git-grammar parsing, delimiter rejection, and writer round-trip behavior.
`test/fixtures/git_config_with_quotes_escapes`	Adjusts fixtures to reflect supported escape handling and remove invalid cases.
`test/fixtures/git_config_multiple`	Updates option naming in fixture to comply with stricter Git-grammar option rules.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

git/config.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

git/config.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Copilot AI review requested due to automatic review settings

July 20, 2026 10:51

Copilot started reviewing on behalf of Byron

July 20, 2026 10:52

View session

Copilot AI reviewed

Jul 20, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

git/config.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Byron force-pushed the fix-config-injection branch from a89ad71 to ecd6844 Compare

July 20, 2026 11:15

Copilot AI review requested due to automatic review settings

July 20, 2026 11:15

Copilot started reviewing on behalf of Byron

July 20, 2026 11:18

View session

Copilot AI reviewed

Jul 20, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

git/config.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

test/test_config.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Copilot AI review requested due to automatic review settings

July 20, 2026 11:36

Copilot started reviewing on behalf of Byron

July 20, 2026 11:36

View session

Copilot AI reviewed

Jul 20, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

git/config.py:911

The section-name quote/bracket scan treats any '"' as starting a quoted subsection, regardless of position. That means inputs like user"] [other" (quote not preceded by whitespace) would be treated as having a quoted ] and pass validation, even though they are not a valid Git quoted-subsection form (<section> "<subsection>"). Tighten the logic so ] is only allowed inside a quoted subsection that starts after whitespace, and reject quotes outside that form (or at least don’t let them suppress the ] check).

                elif in_quotes and char == "\\":
                    escaped = True
                elif char == '"':
                    in_quotes = not in_quotes
                elif char == "]" and not in_quotes:
                    raise ValueError("Git config section names must not contain an unquoted closing bracket")

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

test/test_config.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Copilot AI review requested due to automatic review settings

July 20, 2026 11:50

Byron force-pushed the fix-config-injection branch from 9bee003 to aa4c700 Compare

July 20, 2026 11:50

Copilot started reviewing on behalf of Byron

July 20, 2026 11:51

View session

Copilot AI reviewed

Jul 20, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          fix: validate config section delimiters

1ed1b92

GHSA-3rp5-jjmw-4wv2 identified that configuration section names could alter the
structure of serialized config despite the existing control-character checks.

Reject unquoted closing section delimiters across all writer entry points
while preserving valid delimiters inside quoted subsections and the
existing option-name behavior. Add regression coverage for unsafe plain and
quoted-subsection-shaped names as well as a valid quoted subsection.

Git baseline: a23bace963d508bd96983cc637131392d3face18. Git config parsing
treats an unquoted closing bracket as the end of a basic section header, while
its extended form permits brackets inside a quoted subsection and requires a
final bracket after the closing quote.

Co-authored-by: Sebastian Thiel <[email protected]>

Byron force-pushed the fix-config-injection branch from aa4c700 to 1ed1b92 Compare

July 20, 2026 12:13

Byron merged commit 6a5eb6a into main

Jul 20, 2026

30 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Byron deleted the fix-config-injection branch

July 20, 2026 12:57

ranjiGT mentioned this pull request

Oct 12, 2026

[GHSA-3rp5-jjmw-4wv2] GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE) github/advisory-database#10326

Merged

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

Byron commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tasks

Advisory

Advisory summary

Summary

Git baseline

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Byron commented Jul 20, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.