| Git v2.7.6 Release Notes | |
| ======================== | |
| Fixes since v2.7.5 | |
| ------------------ | |
| * A "ssh://..." URL can result in a "ssh" command line with a | |
| hostname that begins with a dash "-", which would cause the "ssh" | |
| command to instead (mis)treat it as an option. This is now | |
| prevented by forbidding such a hostname (which will not be | |
| necessary in the real world). | |
| * Similarly, when GIT_PROXY_COMMAND is configured, the command is | |
| run with host and port that are parsed out from "ssh://..." URL; | |
| a poorly written GIT_PROXY_COMMAND could be tricked into treating | |
| a string that begins with a dash "-". This is now prevented by | |
| forbidding such a hostname and port number (again, which will not | |
| be necessary in the real world). | |
| * In the same spirit, a repository name that begins with a dash "-" | |
| is also forbidden now. | |
| Credits go to Brian Neel at GitLab, Joern Schneeweisz of Recurity | |
| Labs and Jeff King at GitHub. | |