GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix: validate checkout positional reference options by Byron · Pull Request #2233 · gitpython-developers/GitPython

Conversation

@Byron

@Byron Byron commented Sep 10, 2026

Copy link
Copy Markdown
Member

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

  • refackiew

Everything below this line was generated by Codex GPT-6.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Head.checkout() now includes its positional reference in the existing unsafe-option validation. This keeps validation consistent for keyword arguments and reference names, including references obtained from a clone, while preserving explicit opt-in and normal branch switching.

Advisory summary

GHSA-23mf-xhv8-69c2: severity high; affected package PyPI GitPython, reported range <= 3.1.62. No patched version or CVE is assigned in the advisory. The advisory is unpublished; this description omits its reproduction details.

Validation

  • Both new regression paths failed before the fix.
  • All 30 tests in test/test_refs.py pass (Python 3.12.14, Apple Git 2.50.1), including explicit opt-in, ordinary checkout, and detached HEAD behavior.
  • git diff --check passes.
  • Git behavior reference: local Git checkout 1630431f326e15fcde608827b5ff38422528eb59, builtin/checkout.c pathspec-file handling. A leading argument separator would change branch checkout into path checkout, so this change reuses the existing validation helper.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Copilot AI lite review requested due to automatic review settings September 10, 2026 06:10
Copilot started reviewing on behalf of Byron September 10, 2026 06:11
View session
Copilot AI reviewed Sep 10, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No unresolved review issues remain, and all reviewers assessed it as approval-ready.

Pull request overview

Fixes Head.checkout() validation for unsafe positional references, with regression coverage.

Changes:

  • Validates positional checkout references.
  • Adds tests for local and cloned repositories.
File summaries
File Description
test/test_refs.py Adds regression tests for unsafe references.
git/refs/head.py Validates positional checkout references.
Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@Byron
Byron force-pushed the clone-check-head-ref branch from d03962f to 0f74a9b Compare September 10, 2026 06:30
@Byron @codex
fix: validate checkout positional reference options
8da6508 
<!-- agent -->
Head.checkout checked keyword options but omitted the serialized reference from
its existing unsafe-option validation (GHSA-23mf-xhv8-69c2). Reference names can
originate in a cloned repository, so callers could reach behavior that normally
requires explicit opt-in without supplying any checkout options themselves.

Pass self through the shared option-candidate helper, matching the argument
actually sent to Git. This applies the existing policy to direct and
cloned references, including abbreviated option spellings, while retaining
allow_unsafe_options=True and ordinary checkout semantics. A leading --
separator would instead make the reference a pathspec and break branch
switching.

Add direct-reference regression coverage and a local clone regression
using synthetic file content; the latter also verifies explicit opt-in.
Both regression tests failed before the guard change. All 30 tests in
test/test_refs.py pass with Python 3.12.14 and Apple Git 2.50.1; git diff
--check passes.

Git behavior reference: local git/git checkout at
1630431f326e15fcde608827b5ff38422528eb59, builtin/checkout.c checkout_main
pathspec_from_file handling, which parses file contents as pathspecs. No Git
source was copied.

Assisted-by: GPT 6.0
Co-authored-by: GPT 6.0 <[email protected]>
@Byron
Byron force-pushed the clone-check-head-ref branch from 0f74a9b to 8da6508 Compare September 10, 2026 11:14
Copilot AI review requested due to automatic review settings September 10, 2026 11:14
Copilot started reviewing on behalf of Byron September 10, 2026 11:22
View session
Copilot AI reviewed Sep 10, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No unresolved review comments remain, and the validation, tests, and documentation are covered.

Review details
  • Files reviewed: 3/3 changed files
  • Comments generated: 0 new
  • Review effort level: Lite

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@Byron
Byron merged commit dcb6b14 into main Sep 10, 2026
54 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@Byron
Byron deleted the clone-check-head-ref branch October 5, 2026 03:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@Byron
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.