Jeff King <peff@xxxxxxxx> writes: > It's hard for scripted uses of rev-list, etc, to avoid option injection > from untrusted arguments, because revision arguments must come before > any "--" separator. I.e.: > > git rev-list "$revision" -- "$path" > > might mistake "$revision" for an option (with rev-list, that would make > it an error, but something like git-log would default to HEAD). Just to make sure I understand what I just read, let me paraphrase. We would want to accept git rev-list --max-parents=4 \ --end-of-options \ --count -- docs/ so that '--count' would go thru the usual "as we have -- later, it must be a rev and we do not even disambiguate. What does get_sha1() say it is?" and "docs/" would be taken as a pathspec. "git rev-list --max-parents=4 --count -- docs/" would have treated "--count" as an option and would error out due to lack of any starting revision. On the other hand, "git log --count -- docs/" would take "--count" as an option, but does not complain about lack of any revs. It just starts digging from HEAD and ends up ignoring the "--count" branch (or is this feature meant to support tags? As far as I recall, we do not allow branch names that begin with a dash). > This series provides an alternative to "--" to stop option parsing > without indicating that further arguments are pathspecs. > > [1/3]: revision: allow --end-of-options to end option parsing > [2/3]: parse-options: allow --end-of-options as a synonym for "--" > [3/3]: gitcli: document --end-of-options > > Documentation/gitcli.txt | 6 ++++++ > parse-options.c | 3 ++- > revision.c | 8 +++++++- > t/t0040-parse-options.sh | 7 +++++++ > t/t4202-log.sh | 7 +++++++ > t/t6000-rev-list-misc.sh | 8 ++++++++ > 6 files changed, 37 insertions(+), 2 deletions(-)
