<feed xmlns='http://www.w3.org/2005/Atom'>
<title>delta/python-packages/gitpython.git/git/repo, branch 3.1.30</title>
<subtitle>github.com: gitpython-developers/GitPython.git
</subtitle>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/python-packages/gitpython.git/'/>
<entry>
<title>Merge pull request #1521 from stsewd/block-insecure-options</title>
<updated>2022-12-29T07:09:28+00:00</updated>
<author>
<name>Sebastian Thiel</name>
<email>sebastian.thiel@icloud.com</email>
</author>
<published>2022-12-29T07:09:28+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/python-packages/gitpython.git/commit/?id=678a8fe08dd466fcfe8676294b52887955138960'/>
<id>678a8fe08dd466fcfe8676294b52887955138960</id>
<content type='text'>
Block insecure options and protocols by default</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Block insecure options and protocols by default</pre>
</div>
</content>
</entry>
<entry>
<title>Fix type hint on create_tag</title>
<updated>2022-12-29T07:06:10+00:00</updated>
<author>
<name>Andrew Cassidy</name>
<email>drewcassidy@me.com</email>
</author>
<published>2022-12-29T05:53:50+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/python-packages/gitpython.git/commit/?id=ae6a6e4b088a35c0fc7b17940722c8a515f7bee7'/>
<id>ae6a6e4b088a35c0fc7b17940722c8a515f7bee7</id>
<content type='text'>
pycharm yells at me without this
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
pycharm yells at me without this
</pre>
</div>
</content>
</entry>
<entry>
<title>Block unsafe options and protocols by default</title>
<updated>2022-12-24T01:40:06+00:00</updated>
<author>
<name>Santos Gallegos</name>
<email>stsewd@proton.me</email>
</author>
<published>2022-12-24T01:19:52+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/python-packages/gitpython.git/commit/?id=e6108c7997f5c8f7361b982959518e982b973230'/>
<id>e6108c7997f5c8f7361b982959518e982b973230</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Forbid unsafe protocol URLs in Repo.clone{,_from}()</title>
<updated>2022-12-23T21:16:21+00:00</updated>
<author>
<name>Steve Kowalik</name>
<email>steven@wedontsleep.org</email>
</author>
<published>2022-12-20T06:05:50+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/python-packages/gitpython.git/commit/?id=2625ed9fc074091c531c27ffcba7902771130261'/>
<id>2625ed9fc074091c531c27ffcba7902771130261</id>
<content type='text'>
Since the URL is passed directly to git clone, and the remote-ext helper
will happily execute shell commands, so by default disallow URLs that
contain a "::" unless a new unsafe_protocols kwarg is passed.
(CVE-2022-24439)

Fixes #1515
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Since the URL is passed directly to git clone, and the remote-ext helper
will happily execute shell commands, so by default disallow URLs that
contain a "::" unless a new unsafe_protocols kwarg is passed.
(CVE-2022-24439)

Fixes #1515
</pre>
</div>
</content>
</entry>
<entry>
<title>Fix command injection</title>
<updated>2022-12-21T03:04:06+00:00</updated>
<author>
<name>Santos Gallegos</name>
<email>stsewd@proton.me</email>
</author>
<published>2022-12-21T01:26:37+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/python-packages/gitpython.git/commit/?id=fbf9c7e72218e44bc29eb4907d5c00118370376b'/>
<id>fbf9c7e72218e44bc29eb4907d5c00118370376b</id>
<content type='text'>
Add `--` in some commands that receive user input
and if interpreted as options could lead to remote
code execution (RCE).

There may be more commands that could benefit from `--`
so the input is never interpreted as an option,
but most of those aren't dangerous.

Fixed commands:

- push
- pull
- fetch
- clone/clone_from and friends
- archive (not sure if this one can be exploited, but it doesn't hurt
  adding `--` :))

For anyone using GitPython and exposing any of the GitPython methods to users,
make sure to always validate the input (like if starts with `--`).
And for anyone allowing users to pass arbitrary options, be aware
that some options may lead fo RCE, like `--exc`, `--upload-pack`,
`--receive-pack`, `--config` (https://github.com/gitpython-developers/GitPython/pull/1516).

Ref https://github.com/gitpython-developers/GitPython/issues/1517
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Add `--` in some commands that receive user input
and if interpreted as options could lead to remote
code execution (RCE).

There may be more commands that could benefit from `--`
so the input is never interpreted as an option,
but most of those aren't dangerous.

Fixed commands:

- push
- pull
- fetch
- clone/clone_from and friends
- archive (not sure if this one can be exploited, but it doesn't hurt
  adding `--` :))

For anyone using GitPython and exposing any of the GitPython methods to users,
make sure to always validate the input (like if starts with `--`).
And for anyone allowing users to pass arbitrary options, be aware
that some options may lead fo RCE, like `--exc`, `--upload-pack`,
`--receive-pack`, `--config` (https://github.com/gitpython-developers/GitPython/pull/1516).

Ref https://github.com/gitpython-developers/GitPython/issues/1517
</pre>
</div>
</content>
</entry>
<entry>
<title>feat(blame): Support custom `rev_opts` for blame</title>
<updated>2022-08-31T05:04:34+00:00</updated>
<author>
<name>Joseph Hale</name>
<email>me@jhale.dev</email>
</author>
<published>2022-08-30T06:45:51+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/python-packages/gitpython.git/commit/?id=18a79d8028f934f8f78da33de3b0523fc7d1df47'/>
<id>18a79d8028f934f8f78da33de3b0523fc7d1df47</id>
<content type='text'>
The `git blame` CLI offers a repeated `-C` option that can be used to detect
lines that move within/between files. While a slower operation, it yields more
accurate authorship reports.
https://git-scm.com/docs/git-blame#Documentation/git-blame.txt--Cltnumgt

While GitPython does enable passing custom kwargs to the command line `git`
invocation, the fact that kwargs is a dictionary (i.e. no duplicate keys) means
that there was no way to request the `-C` option in `git blame` more than once.

This commit adds an optional `rev_opts` parameter to the `blame` method which
accepts a list of strings to propagate to the CLI invocation of `git blame`. By
using a `List[str]` for `rev_opts`, users of GitPython can pass now the `-C`
option multiple times to get more detailed authorship reports from `git blame`.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The `git blame` CLI offers a repeated `-C` option that can be used to detect
lines that move within/between files. While a slower operation, it yields more
accurate authorship reports.
https://git-scm.com/docs/git-blame#Documentation/git-blame.txt--Cltnumgt

While GitPython does enable passing custom kwargs to the command line `git`
invocation, the fact that kwargs is a dictionary (i.e. no duplicate keys) means
that there was no way to request the `-C` option in `git blame` more than once.

This commit adds an optional `rev_opts` parameter to the `blame` method which
accepts a list of strings to propagate to the CLI invocation of `git blame`. By
using a `List[str]` for `rev_opts`, users of GitPython can pass now the `-C`
option multiple times to get more detailed authorship reports from `git blame`.
</pre>
</div>
</content>
</entry>
<entry>
<title>docs: add typerror exception to active_branch method</title>
<updated>2022-08-20T11:49:16+00:00</updated>
<author>
<name>Patrick Gerard</name>
<email>info@content-baer.de</email>
</author>
<published>2022-08-20T11:37:48+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/python-packages/gitpython.git/commit/?id=7dda25eafa80fc6cb2dd0a21f992205119270007'/>
<id>7dda25eafa80fc6cb2dd0a21f992205119270007</id>
<content type='text'>
docs: add typerror exception to active_branch method

fix: sphinx syntax

add author
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
docs: add typerror exception to active_branch method

fix: sphinx syntax

add author
</pre>
</div>
</content>
</entry>
<entry>
<title>BUG: Use Cygwin paths for Cygwin git</title>
<updated>2022-06-11T15:21:54+00:00</updated>
<author>
<name>DWesl</name>
<email>22566757+DWesl@users.noreply.github.com</email>
</author>
<published>2022-06-11T15:21:54+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/python-packages/gitpython.git/commit/?id=9be148c65e9e6c7ed6706c12adc785187918da88'/>
<id>9be148c65e9e6c7ed6706c12adc785187918da88</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>STY: Remove import of now-unused function</title>
<updated>2022-06-11T14:01:53+00:00</updated>
<author>
<name>DWesl</name>
<email>22566757+DWesl@users.noreply.github.com</email>
</author>
<published>2022-06-11T14:01:53+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/python-packages/gitpython.git/commit/?id=21113a81560dfea6f2eea5f50ceb5e87e9097c82'/>
<id>21113a81560dfea6f2eea5f50ceb5e87e9097c82</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>BUG: Convert to native path before checking if absolute</title>
<updated>2022-06-11T01:35:40+00:00</updated>
<author>
<name>DWesl</name>
<email>22566757+DWesl@users.noreply.github.com</email>
</author>
<published>2022-06-11T01:35:40+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/python-packages/gitpython.git/commit/?id=5d874ddc5a6cab35812e1ef395c18216f9399425'/>
<id>5d874ddc5a6cab35812e1ef395c18216f9399425</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
</feed>
