fix: block unsafe long-option prefixes (GHSA-2f96-g7mh-g2hx) by Byron · Pull Request #2161 · gitpython-developers/GitPython

Copilot

Pull request overview

This PR addresses GHSA-2f96-g7mh-g2hx by hardening GitPython’s unsafe-option filtering to also reject abbreviated long options (leveraging Git’s acceptance of long-option prefixes), and adds regression tests to prevent bypasses like upload_p → upload-pack.

Changes:

Update Git.check_unsafe_options to treat prefixes of unsafe long options as unsafe.
Add regression tests covering abbreviated unsafe options for clone/fetch/pull/push APIs.
Expand unit coverage for canonicalization and prefix behavior in unsafe-option checks.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
`git/cmd.py`	Implements prefix-aware unsafe-option matching (needs adjustment to avoid blocking safe short options).
`test/test_git.py`	Adds unit cases asserting abbreviated long options are detected as unsafe.
`test/test_remote.py`	Adds fetch/pull/push regression cases for abbreviated unsafe options.
`test/test_clone.py`	Adds clone/clone_from regression cases for abbreviated upload-pack options.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.