GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Cover option-shaped branch operands in checkout by Byron · Pull Request #2344 · gitpython-developers/GitPython

Conversation

Byron commented Nov 12, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

refackiew

Everything below this line was generated by Codex (model version unavailable).

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

This repository-owner follow-up verifies checkout protection for a security report against released GitPython 3.2.1. Current main already contains the class-wide branch operand validation from 212573bf; this PR locks in the additional input variants and documents that contract.

Extend the existing operand and real-clone regressions to cover more option spellings under both unsafe-option settings. Rejection must happen before a Git process launches and preserve the branch, commit, index status, uncommitted file content, and untracked-file status. Document UnsafeOptionError and that branch validation remains active with allow_unsafe_options=True.

Advisory summary

GHSA-f8wj-prgh-h9j7 is a draft advisory with medium severity. The report concerns PyPI package GitPython and tested version 3.2.1. The advisory's structured affected range and patched version are unset, and no CVE is assigned. This description omits reproduction details from the draft advisory. This PR does not publish the advisory or assign a patched release.

Validation

The three additional cloned-branch cases fail with the unaltered Head.checkout() method from tag 3.2.1 (c179357b) loaded into the current harness in a disposable process. This is method-level reproduction, not a full installed-release test.
The affected test/test_positional_args.py and test/test_refs.py modules pass 184 tests and 24 subtests on each backend through test/run-local.py. All four cloned-branch cases also pass on each backend after the final fixture edit.
Python 3.12.14, Git 2.54.0, and GixPython 0.3.0 on macOS; Ruff lint/format, ShellCheck, and whitespace checks pass.
Git reference 6de20f6 (v2.56.0-116-g6de20f6092): check_branch_ref() and t/t1402-check-ref-format.sh reject leading-dash branch names. A separator before the branch would select path checkout semantics.
The required codex review --commit 671ea00 invocation failed before review startup because the sandbox blocked app-server initialization. An independent Codex agent review of the committed change found no actionable issues.

Commit: 671ea00 — test(refs): cover all option-shaped checkout branch operands.

All 67 hosted CI checks pass for 671ea00, including the Linux/macOS/Windows matrix, GixPython, supported-runtime imports, Cygwin, Alpine, lint, documentation, downstream integrations, and the backend benchmark. No CI fixes or retries were needed. There are no review comments or unresolved review threads at completion.

Release preparation and advisory publication remain outside this PR.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          test(refs): cover all option-shaped checkout branch operands

a2d8dea

<!-- agent -->
Current `main` already rejects every
leading-dash branch name through the unconditional `Git._check_operand()`
guard in `Head.checkout()`, introduced in `212573bf`. Preserve that shared
prevention and make its coverage and public contract explicit.

Expand the existing operand tests to short options, attached option values,
and terminators, with both `allow_unsafe_options` settings. Extend the
scripted cloned-branch fixture with uncommitted work, and verify rejection
does not launch Git or change the branch, commit, index status, file content,
or untracked-file status. Document the exception and the independent branch
validation in the API and unreleased changes.

Git's baseline agrees: `check_branch_ref()` rejects leading-dash branch
names, and `t/t1402-check-ref-format.sh` tests that rule. Reference source:
`6de20f6092dcf9bdb1c8efe03db4b70c82b423dd` (`v2.56.0-116-g6de20f6092`).
Placing `--` before the branch would instead select path checkout semantics.

Validation used Python 3.12.14, Git 2.54.0, and GixPython 0.3.0 on macOS:

- The three new cloned-branch cases failed with the unaltered
  `Head.checkout()` method extracted from the `3.2.1` tag at `c179357b` and
  loaded into the current test harness in a disposable process. This was
  method-level reproduction, not a full installed-release test.
- `test/test_positional_args.py` and `test/test_refs.py` passed 184 tests and
  24 subtests on each backend through `test/run-local.py`.
- The final cloned-branch fixture passed all four cases on each backend.
- Ruff lint/format, ShellCheck, and `git diff --check` passed.

No new runtime guard is needed. A patched release and advisory publication
remain repository-owner decisions; neither is performed by this follow-up.

Assisted-by: GPT 6.1 Sol
Co-authored-by: GPT 6.1 Sol <[email protected]>

Byron force-pushed the checkout-fix branch from 671ea00 to a2d8dea Compare

November 12, 2026 10:13

Byron marked this pull request as ready for review

November 12, 2026 10:13

Copilot AI balanced review requested due to automatic review settings

November 12, 2026 10:13

Copilot started reviewing on behalf of Byron

November 12, 2026 10:14

View session

Copilot AI reviewed

Nov 12, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues are reported for the checkout regression coverage and documentation updates.

No open issues 🎉

What changed in this PR

This PR strengthens regression coverage for existing Head.checkout() protections against option-shaped branch names. It adds tests and documentation without changing checkout behavior.

Changes:

Expand branch-name cases under both allow_unsafe_options settings.
Verify cloned-branch checkout rejects unsafe operands before launching Git and preserves repository and working-tree state.
Document UnsafeOptionError, unconditional branch validation, and the related advisory.

File	Description
`tests/fixtures/refs.sh`	Parameterizes the unsafe branch name and adds uncommitted content to the clone fixture.
`test/test_refs.py`	Expands cloned-branch regressions with process-launch and state-preservation assertions.
`test/test_positional_args.py`	Adds short-option, attached-value, and separator-shaped branch operands.
`git/refs/head.py`	Documents branch validation and its exception; no runtime changes.
`doc/source/changes.rst`	Links the advisory and clarifies checkout’s branch-validation contract.

_{Review effort: Balanced}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Byron merged commit 57d278f into main

Nov 12, 2026

67 of 68 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

Byron commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tasks

Advisory summary

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Byron commented Nov 12, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.