The Hidden Danger of Git's --end-of-options Flag for Package Managers
git's –end-of-options Flag
I discovered how the git --end-of-options flag prevents argument injection attacks that have plagued package managers like Bundler, Composer, and Go. While tools like Cargo and Poetry rely on libraries to avoid these risks, most still fork the git binary, leaving them vulnerable to malicious revisions. I explain why standard fixes often fail and why raising minimum git versions is essential for securing dependency chains against these subtle but critical security flaws.
The -- mechanism itself is unsafe by default, since code without it looks correct and works fine right up until an argument starts with a dash.
- metadat
Does anyone know why git broke the long standing convention of "--" early on? Kind of a nightmare for humans to use.
Remembering app-specific one-offs is kind of the worst!
- epistasis
Perhaps I'm missing something (it's been a long day), but couldn't "--" be used for both?
git cmd --options -- rev -- pathspec
would be the fully specified revspec and pathspec
git cmd --option -- rev --
would be just the revspec, excluding accidental options, without a pathspec
git cmd --option revspec -- pathspec
and the single "--" would work as it currently does.
- js2
Folks who didn't click through to the commit[^1] may be missing this reasoning:
> The name is verbose, but that's probably a good thing; this is meant to
be used for scripted invocations where readability is more important
than terseness.
That reasoning makes sense to me. In over a decade of using git, I've never had a case where I'd need to disambiguate a ref that could be confused as an option. And if I did I'd know the ref name so I'd use its full path: `refs/head/--whatever` (just like with `rm` where I prefer `rm ./--whatever` over `rm -- --whatever`).
So yes, this is oddly named, but it was retrofitted so options were limited and it's fine for its intended use case.
(But sure, go ahead HN and use this as yet another post where you can gripe about git's UI. Or tell us how much better jj is. It's boring conversation though.)
[^1]: https://github.com/git/git/commit/19e8789b236dfe33667747d552...