gitpython-developers
diff --git a/‎doc/source/changes.rst‎
Lines changed: 1 addition & 0 deletions b/‎doc/source/changes.rst‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎git/refs/head.py‎
Lines changed: 1 addition & 1 deletion b/‎git/refs/head.py‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎test/test_refs.py‎
Lines changed: 19 additions & 0 deletions b/‎test/test_refs.py‎
Lines changed: 19 additions & 0 deletions
@@ -8,6 +8,7 @@ Changelog
 Security fixes for
 
 * https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-gq48-pqfc-9p58
+* https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2
 
 If you can, also try and provide feedback on the upcoming v4 branch
 https://github.com/gitpython-developers/GitPython/pull/2177 - patches welcome.
 
@@ -283,7 +283,7 @@ def checkout(
         """
         if not allow_unsafe_options:
             Git.check_unsafe_options(
-                options=Git._option_candidates([], kwargs),
+                options=Git._option_candidates([self], kwargs),
                 unsafe_options=Git.unsafe_git_pathspec_from_file_options,
             )
         kwargs["f"] = force
 
@@ -289,6 +289,25 @@ def test_head_checkout_rejects_pathspec_from_file(self, rw_repo):
                         pathspec_file_nul=True,
                         **{option_name: str(pathspecs)},
                     )
+            for option_name in ("--pathspec-from-file", "--pathspec-from"):
+                branch = Head(rw_repo, f"refs/heads/{option_name}={pathspecs}")
+                with self.assertRaises(UnsafeOptionError):
+                    branch.checkout()
+
+    def test_cloned_head_checkout_rejects_pathspec_from_file(self):
+        with tempfile.TemporaryDirectory() as tdir:
+            base_dir = Path(tdir)
+            with self._repo_with_initial_commit(base_dir) as source:
+                branch = source.create_head("--pathspec-from-file=pathspecs")
+                source.head.reference = branch
+                with Repo.clone_from(source.working_tree_dir, base_dir / "clone") as cloned:
+                    (base_dir / "clone" / "pathspecs").write_text("unmatched-private-content\n", encoding="utf-8")
+                    assert cloned.active_branch.name == branch.name
+                    with self.assertRaises(UnsafeOptionError):
+                        cloned.active_branch.checkout()
+                    with self.assertRaises(GitCommandError) as error:
+                        cloned.active_branch.checkout(allow_unsafe_options=True)
+                    assert "unmatched-private-content" in str(error.exception)
 
     @with_rw_repo("HEAD")
     def test_head_reset_rejects_pathspec_from_file(self, rw_repo):
Original file line number	Diff line number	Diff line change
`@@ -283,7 +283,7 @@ def checkout(`
`283`	`283`	`"""`
`284`	`284`	`if not allow_unsafe_options:`
`285`	`285`	`Git.check_unsafe_options(`
`286`		`- options=Git._option_candidates([], kwargs),`
	`286`	`+ options=Git._option_candidates([self], kwargs),`
`287`	`287`	`unsafe_options=Git.unsafe_git_pathspec_from_file_options,`
`288`	`288`	`)`
`289`	`289`	`kwargs["f"] = force`