Reject option-shaped pull operands
fix(remote): reject option-shaped pull operands
Reject option-shaped pull operands790bb3-fix-reject-option-shaped-pull-operands-cve-2026-110858fixreject option shaped pull operands remote
Committed by Byron
commit message
fix(remote): reject option-shaped pull operands
<!-- agent -->
`Remote.pull()` validated keyword options but forwarded refspecs through
`git pull`, whose internal fetch invocation loses the `--` separator.
GHSA-f9j4-qggq-h239 reports the resulting positional validation bypass.
Reject all leading-dash refspecs and remote names before spawning Git,
rather than trying to enumerate dangerous option spellings. This also
applies with `allow_unsafe_options=True`: explicit options still belong in
keyword arguments. Document the behavior and add an unreleased changelog
entry. No shell quoting change is needed; the problem is Git's own option
parsing, not splitting arguments in Python.
Git reference: `builtin/pull.c:run_fetch()` at Git commit
`12cb6293d6288865c1a133cf22accbaf99d13eb6` forwards the remote and refspecs
without an option terminator. Tested with Apple Git 2.54.0.
Assisted-by: GPT 6.0
Co-authored-by: GPT 6.0 <[email protected]>Editor assessment
This commit patches CVE-2026-110858. Exemplary. The subject states the defense and the body explains the full issue: Remote.pull validated keyword options but forwarded refspecs through git pull, whose internal fetch loses the -- separator, so leading-dash refspecs were parsed as options. It then justifies rejecting all leading-dash refspecs instead of enumerating dangerous spellings, notes the allow_unsafe_options behavior, and cites the exact Git source. Complete and teaching. Style-wise the body is well separated, the scope accurate and the footer guidance clear; no formal change is needed.