Pull request overview

This PR hardens two parsing surfaces in GitPython that can process attacker-controlled input: diff path decoding (C-style quoted paths) and Actor identity parsing. It aligns behavior more closely with Git while preventing pathological parsing cases (e.g., reinterpretation of escaped backslashes as octal byte escapes, and regex backtracking blowups).

Changes:

• Replaces multi-step quoted diff path decoding with a single-pass C-style unquoter to avoid double-interpretation of escapes.
• Reworks Actor._from_string to use bounded delimiter scans (no regex backtracking) while preserving existing multiline/malformed parsing behavior.
• Adds targeted regression tests for both hardened parsers.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

test/test_actor.py:35

• This test asserts on an internal implementation detail (vars(Actor) lacking name_email_regex). That makes the test brittle to refactors that still satisfy the security property (no catastrophic backtracking) and may fail even if behavior remains correct. Prefer asserting only on externally observable behavior.

    def test_from_string_handles_unterminated_email_without_regex_backtracking(self):
        value = "A" * 20_000 + " <unterminated"
        actor = Actor._from_string(value)
        self.assertNotIn("name_email_regex", vars(Actor))
        self.assertEqual(actor, Actor(value, None))

doc/source/changes.rst:11

• PR description lists fixes for both GHSA-g5vv-9gxw-82hx and GHSA-v6xg-m7rh-r365, but the 3.1.60 changelog entry only references GHSA-g5vv-9gxw-82hx. If both advisories are addressed by this release, add the missing advisory link here (or update the PR description if only one is in scope).

Security fixes for

* https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx

git/diff.py:126

• In _unquote_path, the escapes dict is re-created on every call. decode_path() is used while parsing diff headers, so this extra allocation can add overhead for large diffs. Consider hoisting the escape table to a module-level constant and reusing it.

def _unquote_path(path: bytes) -> bytes:
    result = bytearray()
    escapes = {
        ord("a"): 7,
        ord("b"): 8,
        ord("f"): 12,
        ord("n"): 10,
        ord("r"): 13,
        ord("t"): 9,
        ord("v"): 11,
    }