git.cmd: harden unsafe option canonicalization and isolate push test … · gitpython-developers/GitPython@43d92de · GitHub

gitpython-developers / GitPython Public

• Notifications You must be signed in to change notification settings
• Fork 989
• Star 5.2k

• Code
• Issues 8
• Pull requests 2
• Discussions
• Actions
• Security and quality 34
• Insights

Additional navigation options

Commit 43d92de

Browse filesBrowse the repository at this point in the historyBrowse files

WesR

committed

git.cmd: harden unsafe option canonicalization and isolate push test cases

1 parent 9aed7cf commit 43d92de
Copy full SHA for 43d92de

2 files changed

+18-12Lines changed: 18 additions & 12 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• git
  • cmd.py
• test
  • test_remote.py

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎git/cmd.py‎

Copy file name to clipboardExpand all lines: git/cmd.py

+12-3Lines changed: 12 additions & 3 deletions

Original file line number	Diff line number	Diff line change
@@ -946,9 +946,18 @@ def check_unsafe_protocols(cls, url: str) -> None:
946	946
947	947	@classmethod
948	948	def _canonicalize_option_name(cls, option: str) -> str:
949		- """Normalize an option or kwarg name for unsafe-option checks."""
950		- option_name = option.lstrip("-").split("=", 1)[0].split(None, 1)[0]
951		- return dashify(option_name)
	949	+ """Return the option name used for unsafe-option checks.
	950	+
	951	+ Examples:
	952	+ ``"--upload-pack=/tmp/helper"`` -> ``"upload-pack"``
	953	+ ``"upload_pack"`` -> ``"upload-pack"``
	954	+ ``"--config core.filemode=false"`` -> ``"config"``
	955	+ """
	956	+ option_name = option.lstrip("-").split("=", 1)[0]
	957	+ option_tokens = option_name.split(None, 1)
	958	+ if not option_tokens:
	959	+ return ""
	960	+ return dashify(option_tokens[0])
952	961
953	962	@classmethod
954	963	def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:

Collapse file

‎test/test_remote.py‎

Copy file name to clipboardExpand all lines: test/test_remote.py

+6-9Lines changed: 6 additions & 9 deletions

Original file line number	Diff line number	Diff line change
@@ -964,11 +964,9 @@ def test_push_unsafe_options(self, rw_repo):
964	964	tmp_dir = Path(tdir)
965	965	tmp_file = tmp_dir / "pwn"
966	966	unsafe_options = [
967		- {
968		- "receive-pack": f"touch {tmp_file}",
969		- "receive_pack": f"touch {tmp_file}",
970		- "exec": f"touch {tmp_file}",
971		- }
	967	+ {"receive-pack": f"touch {tmp_file}"},
	968	+ {"receive_pack": f"touch {tmp_file}"},
	969	+ {"exec": f"touch {tmp_file}"},
972	970	]
973	971	for unsafe_option in unsafe_options:
974	972	assert not tmp_file.exists()
@@ -992,10 +990,9 @@ def test_push_unsafe_options_allowed(self, rw_repo):
992	990	tmp_dir = Path(tdir)
993	991	tmp_file = tmp_dir / "pwn"
994	992	unsafe_options = [
995		- {
996		- "receive-pack": f"touch {tmp_file}",
997		- "exec": f"touch {tmp_file}",
998		- }
	993	+ {"receive-pack": f"touch {tmp_file}"},
	994	+ {"receive_pack": f"touch {tmp_file}"},
	995	+ {"exec": f"touch {tmp_file}"},
999	996	]
1000	997	for unsafe_option in unsafe_options:
1001	998	# The options will be allowed, but the command will fail.

0 commit comments

Comments

0 (0)