Title: Harden unsafe Git option validation by Byron · Pull Request #2180 · gitpython-developers/GitPython · GitHub
Open Graph Title: Harden unsafe Git option validation by Byron · Pull Request #2180 · gitpython-developers/GitPython
X Title: Harden unsafe Git option validation by Byron · Pull Request #2180 · gitpython-developers/GitPython
Description: Tasks This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here. refackiew Everything below this line was generated by Codex GPT-5. Created by Codex on behalf of Byron. Byron will review before this is ready to merge. Summary Harden GitPython's unsafe-option validation against three high-severity advisories affecting GitPython <= 3.1.53: GHSA-r9mr-m37c-5fr3: prevent split single-character keyword values from smuggling unsafe option tokens. GHSA-6p8h-3wgx-97gf: reject caller-controlled clone templates by default because they can install executable hooks. GHSA-fjr4-x663-mwxc: reject diff output options before revision parsing or Git invocation to prevent arbitrary file overwrite. No CVEs or patched release versions are assigned yet. Changes Validate option-like values emitted when single-character kwargs are split. Add --template to the unsafe clone-option denylist. Add allow_unsafe_options=False to commit/tree/index diff paths and consistently guard --output/-o. Preserve explicit opt-in behavior with allow_unsafe_options=True. Add regression coverage for each bypass and affected call path. Validation Focused Python 3.12 security tests: 3 passed. Ruff lint and formatting: passed. Mypy: passed. Full pre-commit suite: passed. Full Python 3.12 suite: 667 passed, 75 skipped, 35 unrelated fixture/environment failures caused by uninitialized nested test submodules and local Git defaults. Git behavior was checked against baseline a23bace9.
Open Graph Description: Tasks This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here. refackiew Everything below this line was generated by C...
X Description: Tasks This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here. refackiew Everything below this line was generated by C...
Opengraph URL: https://github.com/gitpython-developers/GitPython/pull/2180
X: @github
Domain: Github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:a5187391-90aa-0a43-2664-8f6d71d022eb |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | 9084:EEFB6:4FB5A9:7070F4:6A630DF6 |
| html-safe-nonce | a7bc447feaf4f5073f8b2d15736661e5d580d1909d084e94e237212956a9e6e2 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI5MDg0OkVFRkI2OjRGQjVBOTo3MDcwRjQ6NkE2MzBERjYiLCJ2aXNpdG9yX2lkIjoiNjE4NTkxNTg1NjMxOTYxNDQ1NCIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | 2728dca66ed77a1e7da5af7b834d5ff13f3cbe0d6bd1f7844747d4b3f924269d |
| hovercard-subject-tag | pull_request:4104720003 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/gitpython-developers/GitPython/pull/2180/files |
| twitter:image | https://avatars.githubusercontent.com/u/63622?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/63622?s=400&v=4 |
| og:image:alt | Tasks This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here. refackiew Everything below this line was generated by C... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 1a6c056e02f174fffc096c521ec0ff6fb83e40a2ec8cb8875466ec1524872dd6 |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/gitpython-developers/GitPython git https://github.com/gitpython-developers/GitPython.git |
| octolytics-dimension-user_id | 503709 |
| octolytics-dimension-user_login | gitpython-developers |
| octolytics-dimension-repository_id | 1126087 |
| octolytics-dimension-repository_nwo | gitpython-developers/GitPython |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 1126087 |
| octolytics-dimension-repository_network_root_nwo | gitpython-developers/GitPython |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 6a93e25585f487ddff9e3996c06d5b869d6e1828 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width