GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Harden diff path and actor identity parsing by Byron · Pull Request #2215 · gitpython-developers/GitPython

Conversation

Byron commented Aug 11, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

refackiew

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Summary

Decode Git C-style quoted diff paths in one pass so escaped literal backslashes cannot be reinterpreted as byte escapes.
Parse actor identities with Git-style delimiter scans instead of backtracking regular expressions.
Use GitPython’s whole-string fallback when an actor delimiter is missing.

Advisory summary

GHSA-v6xg-m7rh-r365: high severity; GitPython 3.1.59; no patched version or CVE assigned.
GHSA-g5vv-9gxw-82hx: high severity; GitPython <= 3.1.59; no patched version or CVE assigned.

The implementation and this description are intentionally limited to the input-validation classes and do not reproduce private proof-of-concept details.

References

Behavior was checked against Git cf5497b14c5a24f10c13f7e0ee85cb95 (quote.c::unquote_c_style, ident.c::split_ident_line, and invalid-committer tests) and the local gix-actor signature parser/tests.

Validation

Focused quoted-path regression: passed.
test/test_diff.py: 24 passed, 1 environment-sensitive existing failure in test_diff_with_staged_file (expected two conflict entries, got zero).
test/test_actor.py: 7 passed.
TestUtils::test_actor_from_string: passed.
Ruff check and format checks: passed.
Codex review: clean for both final commit hashes.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

chatgpt-codex-connector[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Byron marked this pull request as ready for review

August 11, 2026 12:42

Copilot AI lite review requested due to automatic review settings

August 11, 2026 12:42

Copilot started reviewing on behalf of Byron

August 11, 2026 12:43

View session

Byron force-pushed the various-fixes branch from 81ef4cb to 06b9e17 Compare

August 11, 2026 12:44


          fix: decode quoted diff paths in one pass

9a92677

<!-- agent -->
GHSA-v6xg-m7rh-r365 (closed) reports that quoted patch paths can crash or
silently change when an escaped literal backslash precedes digits.

Add regression coverage distinguishing literal backslashes from real
octal byte escapes, then decode Git's C-style quoting sequentially so
one escape cannot be reinterpreted by a later pass. Match Git baseline
cf5497b14c5a24f10c13f7e0ee85cb95af13ea6a quote.c::unquote_c_style by
accepting octal bytes only when all three digits are valid and the first
is 0 through 3.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <[email protected]>

Copilot AI reviewed

Aug 11, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens two parsing surfaces in GitPython that can process attacker-controlled input: diff path decoding (C-style quoted paths) and Actor identity parsing. It aligns behavior more closely with Git while preventing pathological parsing cases (e.g., reinterpretation of escaped backslashes as octal byte escapes, and regex backtracking blowups).

Changes:

Replaces multi-step quoted diff path decoding with a single-pass C-style unquoter to avoid double-interpretation of escapes.
Reworks Actor._from_string to use bounded delimiter scans (no regex backtracking) while preserving existing multiline/malformed parsing behavior.
Adds targeted regression tests for both hardened parsers.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
`git/diff.py`	Implements single-pass decoding of Git C-style quoted diff paths via `_unquote_path`, used by `decode_path`.
`git/util.py`	Replaces regex-based `Actor._from_string` parsing with delimiter scanning to avoid backtracking.
`test/test_diff.py`	Adds regression test ensuring escaped backslashes aren’t reinterpreted as octal byte escapes.
`test/test_actor.py`	Adds tests covering large unterminated emails (anti-backtracking) and newline-bounded parsing.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Copilot AI review requested due to automatic review settings

August 11, 2026 12:47

Byron force-pushed the various-fixes branch from 06b9e17 to b6386b8 Compare

August 11, 2026 12:48

Copilot started reviewing on behalf of Byron

August 11, 2026 12:58

View session

Copilot AI reviewed

Aug 11, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          fix: parse actor identities without regular expressions

751473a

<!-- agent -->
GHSA-g5vv-9gxw-82hx reports quadratic backtracking when an actor
identity contains a long unterminated email delimiter.

Add a regression that exercises a 20,000-character malformed identity,
then replace both actor regexes with direct delimiter scans following
Git's first-opening, first-closing delimiter behavior. Keep GitPython's
whole-string fallback when either delimiter is absent.

Reference Git baseline cf5497b14c5a24f10c13f7e0ee85cb95
ident.c::split_ident_line and its invalid-committer cases in
t/t9300-fast-import.sh. Also reference gix-actor's signature decoder and
lenient identity tests.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <[email protected]>

Copilot AI review requested due to automatic review settings

August 11, 2026 13:07

Byron force-pushed the various-fixes branch from b6386b8 to 751473a Compare

August 11, 2026 13:07

Copilot started reviewing on behalf of Byron

August 11, 2026 13:11

View session

Copilot AI reviewed

Aug 11, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (3)

test/test_actor.py:35

This test asserts on an internal implementation detail (vars(Actor) lacking name_email_regex). That makes the test brittle to refactors that still satisfy the security property (no catastrophic backtracking) and may fail even if behavior remains correct. Prefer asserting only on externally observable behavior.

    def test_from_string_handles_unterminated_email_without_regex_backtracking(self):
        value = "A" * 20_000 + " <unterminated"
        actor = Actor._from_string(value)
        self.assertNotIn("name_email_regex", vars(Actor))
        self.assertEqual(actor, Actor(value, None))

doc/source/changes.rst:11

PR description lists fixes for both GHSA-g5vv-9gxw-82hx and GHSA-v6xg-m7rh-r365, but the 3.1.60 changelog entry only references GHSA-g5vv-9gxw-82hx. If both advisories are addressed by this release, add the missing advisory link here (or update the PR description if only one is in scope).

Security fixes for

* https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx

git/diff.py:126

In _unquote_path, the escapes dict is re-created on every call. decode_path() is used while parsing diff headers, so this extra allocation can add overhead for large diffs. Consider hoisting the escape table to a module-level constant and reusing it.

def _unquote_path(path: bytes) -> bytes:
    result = bytearray()
    escapes = {
        ord("a"): 7,
        ord("b"): 8,
        ord("f"): 12,
        ord("n"): 10,
        ord("r"): 13,
        ord("t"): 9,
        ord("v"): 11,
    }

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Byron merged commit f44c1fb into main

Aug 11, 2026

54 checks passed

Uh oh!

There was an error while loading. Please reload this page.

alexFiorenza mentioned this pull request

Aug 25, 2026

ci: pin the release tooling instead of rebuilding it unpinned every run gaussia-labs/pyboltzmann#17

Merged

elliotloftus mentioned this pull request

Aug 25, 2026

AttributeError: type object 'Actor' has no attribute 'name_email_regex' (GitPython 3.1.60) python-semantic-release/python-semantic-release#1475

Closed

karthikbekalp mentioned this pull request

Aug 26, 2026

chore: pin gitpython below 3.1.60 for release bump aws-deadline/deadline-cloud-test-fixtures#324

Merged

htkuan mentioned this pull request

Aug 27, 2026

ci(release): pin gitpython below 3.1.60 so semantic-release can load config htkuan/ai-agent-bridge#68

Merged

Byron deleted the various-fixes branch

October 5, 2026 03:24

This was referenced Oct 26, 2026

🟠 [High] GitPython: Denial of Service via Catastrophic Backtracking (ReDoS) in Actor.name_email_regex — Commit Author/Committer Field Parsing Latch/connectedhomeip#62

Open

🟠 [High] GitPython: Denial of Service via Catastrophic Backtracking (ReDoS) in Actor.name_email_regex — Commit Author/Committer Field Parsing Latch/connectedhomeip#67

Open

🟠 [High] GitPython: Denial of Service via Catastrophic Backtracking (ReDoS) in Actor.name_email_regex — Commit Author/Committer Field Parsing Latch/connectedhomeip#78

Open

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

Byron commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tasks

Summary

Advisory summary

References

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Byron commented Aug 11, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.