fix: block unsafe long-option prefixes (GHSA-2f96-g7mh-g2hx) [ruff-format]

codex · Byron · commit ae091b7d017b · 2026-06-17T13:45:46.000+08:00
diff --git a/git/cmd.py b/git/cmd.py
@@ -967,11 +967,21 @@ def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) ->
         arbitrary commands. These are blocked by default.
         """
         # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`.
-        canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options}
+        # We also treat long-option prefix forms as unsafe, matching Git's option
+        # parser behavior for long options.
+        canonical_unsafe_options = [(cls._canonicalize_option_name(option), option) for option in unsafe_options]
         for option in options:
-            unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option))
-            if unsafe_option is not None:
-                raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.")
+            canonical_option = cls._canonicalize_option_name(option)
+            if not canonical_option:
+                continue
+            for (
+                canonical_unsafe_option,
+                unsafe_option,
+            ) in canonical_unsafe_options:
+                if canonical_unsafe_option.startswith(canonical_option):
+                    raise UnsafeOptionError(
+                        f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
+                    )
 
     AutoInterrupt: TypeAlias = _AutoInterrupt
 
diff --git a/test/test_clone.py b/test/test_clone.py
@@ -129,6 +129,7 @@ def test_clone_unsafe_options(self, rw_repo):
             unsafe_options = [
                 {"upload-pack": f"touch {tmp_file}"},
                 {"upload_pack": f"touch {tmp_file}"},
+                {"upload_p": f"touch {tmp_file}"},
                 {"u": f"touch {tmp_file}"},
                 {"config": "protocol.ext.allow=always"},
                 {"c": "protocol.ext.allow=always"},
@@ -218,6 +219,7 @@ def test_clone_from_unsafe_options(self, rw_repo):
             unsafe_options = [
                 {"upload-pack": f"touch {tmp_file}"},
                 {"upload_pack": f"touch {tmp_file}"},
+                {"upload_p": f"touch {tmp_file}"},
                 {"u": f"touch {tmp_file}"},
                 {"config": "protocol.ext.allow=always"},
                 {"c": "protocol.ext.allow=always"},
diff --git a/test/test_git.py b/test/test_git.py
@@ -158,10 +158,16 @@ def test_it_transforms_kwargs_into_git_command_arguments(self):
     def test_check_unsafe_options_normalizes_kwargs(self):
         cases = [
             (["upload_pack"], ["--upload-pack"]),
+            (["upload_p"], ["--upload-pack"]),
+            (["upload_pac"], ["--upload-pack"]),
             (["receive_pack"], ["--receive-pack"]),
+            (["receive_p"], ["--receive-pack"]),
             (["exec"], ["--exec"]),
+            (["exe"], ["--exec"]),
             (["u"], ["-u"]),
             (["c"], ["-c"]),
+            (["conf"], ["--config"]),
+            (["confi"], ["--config"]),
             (["--upload-pack=/tmp/helper"], ["--upload-pack"]),
             (["--config core.filemode=false"], ["--config"]),
         ]
diff --git a/test/test_remote.py b/test/test_remote.py
@@ -832,7 +832,11 @@ def test_fetch_unsafe_options(self, rw_repo):
             remote = rw_repo.remote("origin")
             tmp_dir = Path(tdir)
             tmp_file = tmp_dir / "pwn"
-            unsafe_options = [{"upload-pack": f"touch {tmp_file}"}, {"upload_pack": f"touch {tmp_file}"}]
+            unsafe_options = [
+                {"upload-pack": f"touch {tmp_file}"},
+                {"upload_pack": f"touch {tmp_file}"},
+                {"upload_p": f"touch {tmp_file}"},
+            ]
             for unsafe_option in unsafe_options:
                 with self.assertRaises(UnsafeOptionError):
                     remote.fetch(**unsafe_option)
@@ -900,7 +904,11 @@ def test_pull_unsafe_options(self, rw_repo):
             remote = rw_repo.remote("origin")
             tmp_dir = Path(tdir)
             tmp_file = tmp_dir / "pwn"
-            unsafe_options = [{"upload-pack": f"touch {tmp_file}"}, {"upload_pack": f"touch {tmp_file}"}]
+            unsafe_options = [
+                {"upload-pack": f"touch {tmp_file}"},
+                {"upload_pack": f"touch {tmp_file}"},
+                {"upload_p": f"touch {tmp_file}"},
+            ]
             for unsafe_option in unsafe_options:
                 with self.assertRaises(UnsafeOptionError):
                     remote.pull(**unsafe_option)
@@ -971,7 +979,9 @@ def test_push_unsafe_options(self, rw_repo):
             unsafe_options = [
                 {"receive-pack": f"touch {tmp_file}"},
                 {"receive_pack": f"touch {tmp_file}"},
+                {"receive_p": f"touch {tmp_file}"},
                 {"exec": f"touch {tmp_file}"},
+                {"exe": f"touch {tmp_file}"},
             ]
             for unsafe_option in unsafe_options:
                 assert not tmp_file.exists()
