Reject abbreviated unsafe git options

Git's parse-options machinery accepts an unambiguous prefix of a long option. In the reference Git checkout, parse-options.c records abbreviated matches in parse_long_opt() and dispatches the abbreviated option when it is not ambiguous.

GitPython normalized unsafe option names before comparing them to the deny-list, but only exact canonical names were rejected. That allowed forms such as --upl=... to bypass the --upload-pack guard while still being interpreted by Git as the unsafe option.

Make the shared unsafe-option check reject non-empty canonical candidates that are prefixes of blocked canonical option names, while preserving exact-match behavior. Add coverage for the shared helper and for clone, fetch, pull, push, and ls-remote abbreviation forms.

Validation:
- .venv/bin/python -m compileall -q git/cmd.py test/test_git.py test/test_clone.py test/test_remote.py
- git diff --check
- Focused pytest/unittest execution could not run because the environment is missing pytest, ddt, and gitdb, and PyPI access failed while installing test-requirements.txt.

Author: codex

git/cmd.py

@@ -974,7 +974,17 @@ def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) ->
         # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`.
         canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options}
         for option in options:
-            unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option))
+            canonical_option = cls._canonicalize_option_name(option)
+            unsafe_option = canonical_unsafe_options.get(canonical_option)
+            if unsafe_option is None and canonical_option:
+                unsafe_option = next(
+                    (
+                        unsafe_option
+                        for canonical_unsafe_option, unsafe_option in canonical_unsafe_options.items()
+                        if canonical_unsafe_option.startswith(canonical_option)
+                    ),
+                    None,
+                )
             if unsafe_option is not None:
                 raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.")
 

test/test_clone.py

@@ -117,8 +117,10 @@ def test_clone_unsafe_options(self, rw_repo):
             tmp_file = tmp_dir / "pwn"
             unsafe_options = [
                 f"--upload-pack='touch {tmp_file}'",
+                f"--upl='touch {tmp_file}'",
                 f"-u 'touch {tmp_file}'",
                 "--config=protocol.ext.allow=always",
+                "--conf=protocol.ext.allow=always",
                 "-c protocol.ext.allow=always",
             ]
             for unsafe_option in unsafe_options:
@@ -129,8 +131,10 @@ def test_clone_unsafe_options(self, rw_repo):
             unsafe_options = [
                 {"upload-pack": f"touch {tmp_file}"},
                 {"upload_pack": f"touch {tmp_file}"},
+                {"upl": f"touch {tmp_file}"},
                 {"u": f"touch {tmp_file}"},
                 {"config": "protocol.ext.allow=always"},
+                {"conf": "protocol.ext.allow=always"},
                 {"c": "protocol.ext.allow=always"},
             ]
             for unsafe_option in unsafe_options:

test/test_git.py

@@ -164,6 +164,9 @@ def test_check_unsafe_options_normalizes_kwargs(self):
             (["c"], ["-c"]),
             (["--upload-pack=/tmp/helper"], ["--upload-pack"]),
             (["--config core.filemode=false"], ["--config"]),
+            (["--upl=/tmp/helper"], ["--upload-pack"]),
+            (["conf"], ["--config"]),
+            (["--out=/tmp/output"], ["--output"]),
         ]
 
         for options, unsafe_options in cases:

test/test_remote.py

@@ -832,7 +832,11 @@ def test_fetch_unsafe_options(self, rw_repo):
             remote = rw_repo.remote("origin")
             tmp_dir = Path(tdir)
             tmp_file = tmp_dir / "pwn"
-            unsafe_options = [{"upload-pack": f"touch {tmp_file}"}, {"upload_pack": f"touch {tmp_file}"}]
+            unsafe_options = [
+                {"upload-pack": f"touch {tmp_file}"},
+                {"upload_pack": f"touch {tmp_file}"},
+                {"upl": f"touch {tmp_file}"},
+            ]
             for unsafe_option in unsafe_options:
                 with self.assertRaises(UnsafeOptionError):
                     remote.fetch(**unsafe_option)
@@ -900,7 +904,11 @@ def test_pull_unsafe_options(self, rw_repo):
             remote = rw_repo.remote("origin")
             tmp_dir = Path(tdir)
             tmp_file = tmp_dir / "pwn"
-            unsafe_options = [{"upload-pack": f"touch {tmp_file}"}, {"upload_pack": f"touch {tmp_file}"}]
+            unsafe_options = [
+                {"upload-pack": f"touch {tmp_file}"},
+                {"upload_pack": f"touch {tmp_file}"},
+                {"upl": f"touch {tmp_file}"},
+            ]
             for unsafe_option in unsafe_options:
                 with self.assertRaises(UnsafeOptionError):
                     remote.pull(**unsafe_option)
@@ -971,7 +979,9 @@ def test_push_unsafe_options(self, rw_repo):
             unsafe_options = [
                 {"receive-pack": f"touch {tmp_file}"},
                 {"receive_pack": f"touch {tmp_file}"},
+                {"rec": f"touch {tmp_file}"},
                 {"exec": f"touch {tmp_file}"},
+                {"exe": f"touch {tmp_file}"},
             ]
             for unsafe_option in unsafe_options:
                 assert not tmp_file.exists()
@@ -1012,14 +1022,22 @@ def test_ls_remote_unsafe_options(self, rw_repo):
         with tempfile.TemporaryDirectory() as tdir:
             tmp_dir = Path(tdir)
             tmp_file = tmp_dir / "pwn"
-            unsafe_options = [{"upload-pack": f"touch {tmp_file}"}, {"upload_pack": f"touch {tmp_file}"}]
+            unsafe_options = [
+                {"upload-pack": f"touch {tmp_file}"},
+                {"upload_pack": f"touch {tmp_file}"},
+                {"upl": f"touch {tmp_file}"},
+            ]
             for unsafe_option in unsafe_options:
                 with self.assertRaises(UnsafeOptionError):
                     rw_repo.git.ls_remote(".", **unsafe_option)
             with self.assertRaises(UnsafeOptionError):
                 rw_repo.git.ls_remote([f"--upload-pack={tmp_file}"], ".")
+            with self.assertRaises(UnsafeOptionError):
+                rw_repo.git.ls_remote([f"--upl={tmp_file}"], ".")
             with self.assertRaises(UnsafeOptionError):
                 rw_repo.git.ls_remote(f"--upload-pack={tmp_file}", ".")
+            with self.assertRaises(UnsafeOptionError):
+                rw_repo.git.ls_remote(f"--upl={tmp_file}", ".")
             with self.assertRaises(UnsafeOptionError):
                 rw_repo.git.ls_remote("--upload-pack", "touch", ".")