Skip to content

fix: reject unsafe output options in Commit.count#2184

Merged
Byron merged 1 commit into
mainfrom
fix-output-arg
Jul 25, 2026
Merged

fix: reject unsafe output options in Commit.count#2184
Byron merged 1 commit into
mainfrom
fix-output-arg

Conversation

@Byron

@Byron Byron commented Jul 25, 2026

Copy link
Copy Markdown
Member

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

  • refackiew

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Summary

  • Validate options forwarded by Commit.count() with the existing revision unsafe-option guard.
  • Preserve the explicit allow_unsafe_options=True escape hatch for trusted callers.
  • Audit internal .git.* calls that can accept Git’s --output option; revision iteration, diff/diff-tree, blame, and archive paths were already guarded, leaving Commit.count() as the missing high-level wrapper.

Advisory summary

The advisory is unpublished, so this public PR intentionally omits unnecessary exploitation detail.

Git reference

Git baseline a23bace963: diff.c defines --output as a shared diff option consumed by setup_revisions; t/t6000-rev-list-misc.sh covers the option with rev-list.

Validation

  • Regression test failed before the fix and passes after it.
  • Focused unsafe-option tests: 3 passed.
  • mypy git/objects/commit.py: passed.
  • Ruff check and format check: passed.
  • Full test/test_commit.py: 33 passed; 2 unrelated local failures because this fixture checkout has no master ref.
  • codex review --commit 056e1f1474ca5d1c8817abe274633f7420c8104d: no findings.

<!-- agent -->

Commit.count forwards keyword arguments to git rev-list but did not apply the
unsafe-option validation used by the sibling revision APIs.

Validate forwarded options with the existing Git.check_unsafe_options helper
and retain the explicit allow_unsafe_options escape hatch. This covers
GHSA-p538-c434-8v24 without adding another option parser.

Git baseline: git.git a23bace963 defines --output as a shared diff option
consumed by setup_revisions; t/t6000-rev-list-misc.sh exercises that option
with rev-list.

Co-authored-by: GPT 5.6 <codex@openai.com>
@Byron
Byron marked this pull request as ready for review July 25, 2026 07:30
Copilot AI review requested due to automatic review settings July 25, 2026 07:30

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR closes a security gap by ensuring Commit.count() rejects unsafe git rev-list options (notably --output/-o) unless explicitly allowed, aligning it with existing unsafe-option protections used elsewhere in GitPython’s revision/diff surfaces.

Changes:

  • Add an allow_unsafe_options escape hatch to Commit.count() and validate forwarded kwargs via Git.check_unsafe_options.
  • Add a regression test asserting Commit.count(output=...) raises UnsafeOptionError.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
git/objects/commit.py Adds unsafe-option validation to Commit.count() with an allow_unsafe_options bypass flag.
test/test_commit.py Adds a regression test ensuring Commit.count() rejects unsafe output options.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread test/test_commit.py
@Byron
Byron merged commit d3e9438 into main Jul 25, 2026
33 checks passed
@Byron
Byron deleted the fix-output-arg branch July 25, 2026 07:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants