From 7f5be6e356e29d02f6669bc9a3c232f0caddf0c8 Mon Sep 17 00:00:00 2001 From: Joe Chen Date: Wed, 15 Jul 2026 22:56:11 -0400 Subject: [PATCH] security: pass --end-of-options to git diff in DiffBinary A base or head revision that begins with a dash was passed positionally to "git diff --full-index --binary", so git could interpret it as a command-line option. A revision such as "--output=/path" made git write the diff to an arbitrary path, an attacker-controlled file write when the revision came from a user-supplied branch name. --- repo_diff.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/repo_diff.go b/repo_diff.go index ffe9d6ca..1e1b3897 100644 --- a/repo_diff.go +++ b/repo_diff.go @@ -168,6 +168,6 @@ func (r *Repository) DiffBinary(base, head string, opts ...DiffBinaryOptions) ([ return NewCommand("diff"). AddOptions(opt.CommandOptions). - AddArgs("--full-index", "--binary", base, head). + AddArgs("--full-index", "--binary", "--end-of-options", base, head). RunInDirWithTimeout(opt.Timeout, r.path) }