{{ message }}
Commit e8d0fbf
fix: validate split short-option values
<!-- agent -->
Single-character keyword arguments are transformed into an option token and
a separate value token. The unsafe-option candidate builder only checked the
keyword name, allowing an option-like value to bypass guards shared by clone,
remote, revision, blame, and archive operations.
Include dash-prefixed values only when short options are actually split,
including sequence values, while preserving bare values and the non-splitting
compatibility path.
Git baseline a23bace9 defines clone -n and --upload-pack as distinct options,
matching the argv boundary this validation now preserves.
Refs GHSA-r9mr-m37c-5fr3.
Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>1 parent faf3c09 commit e8d0fbf
2 files changed
Lines changed: 24 additions & 0 deletions

0 commit comments