The Hidden Danger of Git's --end-of-options Flag for Package Managers
git's –end-of-options Flag
I discovered how the git --end-of-options flag prevents argument injection attacks that have plagued package managers like Bundler, Composer, and Go. While tools like Cargo and Poetry rely on libraries to avoid these risks, most still fork the git binary, leaving them vulnerable to malicious revisions. I explain why standard fixes often fail and why raising minimum git versions is essential for securing dependency chains against these subtle but critical security flaws.
The -- mechanism itself is unsafe by default, since code without it looks correct and works fine right up until an argument starts with a dash.
- metadat
Does anyone know why git broke the long standing convention of "--" early on? Kind of a nightmare for humans to use.
Remembering app-specific one-offs is kind of the worst!
- yobert
So I should name my next branch ‘--‘ is what I'm hearing :)
- bombcar
This is actually one of the few places powershell begins to do something close to shine - the cli mixes data and commands in a way that we really shouldn't have to do.
The saddest thing is even ASCII has characters to help with this but since keyboards can't type them nobody used them.
- bradley13
As with almost any successful system: more and more special features and edge cases get added. Git has become ridiculously complex.
I wonder: would it not be better to tell users with those edge cases to fix their problems some other way? To take an example from the article: why does someone have a filename beginning with a dash? Maybe don't do that.
- Chinjut
The "Everything is text, do everything via text" philosophy has its advantages, and also its disadvantages.
- epistasis
Perhaps I'm missing something (it's been a long day), but couldn't "--" be used for both?
git cmd --options -- rev -- pathspec
would be the fully specified revspec and pathspec
git cmd --option -- rev --
would be just the revspec, excluding accidental options, without a pathspec
git cmd --option revspec -- pathspec
and the single "--" would work as it currently does.
- _blk
> git log --end-of-options "$rev" -- "$path",
Argh, that's when I wished for object oriented shells. Powershell sure isn't perfect but objects encoding their own meaning really helps differentiate those cases (but it may not always help the user if types aren't clear to the reader)
- xyzsparetimexyz
What a mess. Just use jj instead.