GeezerVison is showing github.com — fix: reject unsafe output options in Commit.count by Byron · Pull Request #2184 · gitpython-developers/GitPython
Conversation
Byron
commented
Jul 25, 2026
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
Tasks
This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.
Everything below this line was generated by Codex GPT-5.
Created by Codex on behalf of Byron. Byron will review before this is ready to merge.
Summary
- Validate options forwarded by
Commit.count() with the existing revision unsafe-option guard.
- Preserve the explicit
allow_unsafe_options=True escape hatch for trusted callers.
- Audit internal
.git.* calls that can accept Git’s --output option; revision iteration, diff/diff-tree, blame, and archive paths were already guarded, leaving Commit.count() as the missing high-level wrapper.
Advisory summary
The advisory is unpublished, so this public PR intentionally omits unnecessary exploitation detail.
Git reference
Git baseline a23bace963: diff.c defines --output as a shared diff option consumed by setup_revisions; t/t6000-rev-list-misc.sh covers the option with rev-list.
Validation
- Regression test failed before the fix and passes after it.
- Focused unsafe-option tests: 3 passed.
mypy git/objects/commit.py: passed.- Ruff check and format check: passed.
- Full
test/test_commit.py: 33 passed; 2 unrelated local failures because this fixture checkout has no master ref.
codex review --commit 056e1f1474ca5d1c8817abe274633f7420c8104d: no findings.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
<!-- agent -->
Commit.count forwards keyword arguments to git rev-list but did not apply the
unsafe-option validation used by the sibling revision APIs.
Validate forwarded options with the existing Git.check_unsafe_options helper
and retain the explicit allow_unsafe_options escape hatch. This covers
GHSA-p538-c434-8v24 without adding another option parser.
Git baseline: git.git a23bace963 defines --output as a shared diff option
consumed by setup_revisions; t/t6000-rev-list-misc.sh exercises that option
with rev-list.
Co-authored-by: GPT 5.6 <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR closes a security gap by ensuring Commit.count() rejects unsafe git rev-list options (notably --output/-o) unless explicitly allowed, aligning it with existing unsafe-option protections used elsewhere in GitPython’s revision/diff surfaces.
Changes:
- Add an
allow_unsafe_options escape hatch to Commit.count() and validate forwarded kwargs via Git.check_unsafe_options.
- Add a regression test asserting
Commit.count(output=...) raises UnsafeOptionError.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File |
Description |
git/objects/commit.py |
Adds unsafe-option validation to Commit.count() with an allow_unsafe_options bypass flag. |
test/test_commit.py |
Adds a regression test ensuring Commit.count() rejects unsafe output options. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.