◐ Shell
clean mode source ↗

fix: block unsafe long-option prefixes (GHSA-2f96-g7mh-g2hx) by Byron · Pull Request #2161 · gitpython-developers/GitPython

Expand Up @@ -118,8 +118,13 @@ def test_clone_unsafe_options(self, rw_repo): unsafe_options = [ f"--upload-pack='touch {tmp_file}'", f"-u 'touch {tmp_file}'", f"-utouch {tmp_file}; false", f"-futouch${{IFS}}{tmp_file}; false", f"-qutouch${{IFS}}{tmp_file}; false", "--config=protocol.ext.allow=always", "-c protocol.ext.allow=always", "-cprotocol.ext.allow=always", "-vcprotocol.ext.allow=always", ] for unsafe_option in unsafe_options: with self.assertRaises(UnsafeOptionError): Expand All @@ -129,6 +134,7 @@ def test_clone_unsafe_options(self, rw_repo): unsafe_options = [ {"upload-pack": f"touch {tmp_file}"}, {"upload_pack": f"touch {tmp_file}"}, {"upload_p": f"touch {tmp_file}"}, {"u": f"touch {tmp_file}"}, {"config": "protocol.ext.allow=always"}, {"c": "protocol.ext.allow=always"}, Expand Down Expand Up @@ -191,7 +197,9 @@ def test_clone_safe_options(self, rw_repo): options = [ "--depth=1", "--single-branch", "--origin upload", "-q", "-oupstream", ] for option in options: destination = tmp_dir / option Expand All @@ -207,8 +215,13 @@ def test_clone_from_unsafe_options(self, rw_repo): unsafe_options = [ f"--upload-pack='touch {tmp_file}'", f"-u 'touch {tmp_file}'", f"-utouch {tmp_file}; false", f"-futouch${{IFS}}{tmp_file}; false", f"-qutouch${{IFS}}{tmp_file}; false", "--config=protocol.ext.allow=always", "-c protocol.ext.allow=always", "-cprotocol.ext.allow=always", "-vcprotocol.ext.allow=always", ] for unsafe_option in unsafe_options: with self.assertRaises(UnsafeOptionError): Expand All @@ -218,6 +231,7 @@ def test_clone_from_unsafe_options(self, rw_repo): unsafe_options = [ {"upload-pack": f"touch {tmp_file}"}, {"upload_pack": f"touch {tmp_file}"}, {"upload_p": f"touch {tmp_file}"}, {"u": f"touch {tmp_file}"}, {"config": "protocol.ext.allow=always"}, {"c": "protocol.ext.allow=always"}, Expand Down