fix: block unsafe long-option prefixes (GHSA-2f96-g7mh-g2hx)

[Byron]

Tasks

• basic review

---

Advisory

• Advisory URL: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx
• GHSA: GHSA-2f96-g7mh-g2hx
• Severity: high (estimated CVSS 8.8, CVE-2026-42215 class)
• Affected package/version range: PyPI: GitPython <= 3.1.50 (to latest main at the time of report)
• Patched versions: none

Advisory summary

Git accepts long-option abbreviations, so exact-match unsafe-option checks could be bypassed (upload_p matching upload-pack).

This change keeps unsafe-option checks centralized in Git.check_unsafe_options and rejects canonical option prefixes in addition to exact matches.

Changes

• git/cmd.py: prefix-aware unsafe-option matching against canonicalized option names.
• test/test_git.py: regression cases for abbreviated dangerous option names.
• test/test_remote.py: fetch/pull/push regression cases for abbreviated options.
• test/test_clone.py: clone and clone_from regression cases for abbreviated upload options.

Validation

• stg show c705fe7e... (contains the comment-only fix-up on top of the advisory patch stack)
• git rev-parse c705fe7e
• codex review --commit c705fe7e (no blocking findings; comment-only change)
• Focused pytest execution could not be run here because pytest is not installed in this environment.

---

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

[Copilot]

Pull request overview

This PR addresses GHSA-2f96-g7mh-g2hx by hardening GitPython’s unsafe-option filtering to also reject abbreviated long options (leveraging Git’s acceptance of long-option prefixes), and adds regression tests to prevent bypasses like upload_p → upload-pack.

Changes:

• Update Git.check_unsafe_options to treat prefixes of unsafe long options as unsafe.
• Add regression tests covering abbreviated unsafe options for clone/fetch/pull/push APIs.
• Expand unit coverage for canonicalization and prefix behavior in unsafe-option checks.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
git/cmd.py	Implements prefix-aware unsafe-option matching (needs adjustment to avoid blocking safe short options).
test/test_git.py	Adds unit cases asserting abbreviated long options are detected as unsafe.
test/test_remote.py	Adds fetch/pull/push regression cases for abbreviated unsafe options.
test/test_clone.py	Adds clone/clone_from regression cases for abbreviated upload-pack options.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.