Jeff King <[email protected]> writes:
> It's hard for scripted uses of rev-list, etc, to avoid option injection
> from untrusted arguments, because revision arguments must come before
> any "--" separator. I.e.:
>
> git rev-list "$revision" -- "$path"
>
> might mistake "$revision" for an option (with rev-list, that would make
> it an error, but something like git-log would default to HEAD).
Just to make sure I understand what I just read, let me paraphrase.
We would want to accept
git rev-list --max-parents=4 \
--end-of-options \
--count -- docs/
so that '--count' would go thru the usual "as we have -- later, it
must be a rev and we do not even disambiguate. What does get_sha1()
say it is?" and "docs/" would be taken as a pathspec.
"git rev-list --max-parents=4 --count -- docs/" would have treated
"--count" as an option and would error out due to lack of any
starting revision.
On the other hand, "git log --count -- docs/" would take "--count"
as an option, but does not complain about lack of any revs. It just
starts digging from HEAD and ends up ignoring the "--count" branch
(or is this feature meant to support tags? As far as I recall, we
do not allow branch names that begin with a dash).
> This series provides an alternative to "--" to stop option parsing
> without indicating that further arguments are pathspecs.
>
> [1/3]: revision: allow --end-of-options to end option parsing
> [2/3]: parse-options: allow --end-of-options as a synonym for "--"
> [3/3]: gitcli: document --end-of-options
>
> Documentation/gitcli.txt | 6 ++++++
> parse-options.c | 3 ++-
> revision.c | 8 +++++++-
> t/t0040-parse-options.sh | 7 +++++++
> t/t4202-log.sh | 7 +++++++
> t/t6000-rev-list-misc.sh | 8 ++++++++
> 6 files changed, 37 insertions(+), 2 deletions(-)
