fix: block joined short unsafe clone options

[Byron]

Tasks

• refackiew
• @EliahKagan review, and particularly to check if this would sufficiently resolve the advisory. To me it seems so.

---

Advisory

• URL: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v396-v7q4-x2qj
• GHSA ID: GHSA-v396-v7q4-x2qj
• Severity: high
• Affected package: GitPython
• Vulnerable range: = 3.1.50
• Patched versions: unreleased at time of writing

Changes

• Normalize short-form clone options with attached values for unsafe-option checks in Git._canonicalize_option_name, so inputs like -u/tmp/helper and -cprotocol.ext.allow=always are correctly classified as -u and -c.
• Added regression coverage for joined short -u... and -c... bypass forms in test_clone_unsafe_options and test_clone_from_unsafe_options.
• Added explicit unsafe-option canonicalization assertions in test_check_unsafe_options_normalizes_kwargs.

---

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Validation

• gh pr checks 2162 --watch completed successfully (latest run on this PR head).
• Codex review run for commit 2568f2b7.

[Copilot]

Pull request overview

This PR hardens GitPython’s unsafe-option detection for clone by ensuring short options with joined/attached values (e.g. -u/tmp/helper, -cprotocol.ext.allow=always) are canonicalized correctly during unsafe-option checks, closing a bypass described in GHSA-v396-v7q4-x2qj.

Changes:

• Update Git._canonicalize_option_name to normalize joined short options to their single-letter form for unsafe-option matching.
• Add regression tests ensuring joined -u... and -c... forms are rejected in Repo.clone and Repo.clone_from.
• Add canonicalization-focused assertions in the Git.check_unsafe_options normalization tests.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
git/cmd.py	Canonicalizes short -xVALUE option tokens to x for unsafe-option checks, preventing bypass via joined short options.
test/test_clone.py	Adds regression cases for joined -u... and -c... in clone-related unsafe-option tests.
test/test_git.py	Adds direct check_unsafe_options cases asserting joined short options normalize to the expected unsafe keys.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Byron]

Actually, this might be a partial implementation of #2161, which also mentions how short options can be concatenated to hide the actual option.

[Byron]

Closing based on this discovery.