gitflash 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f754910573873164cbdb81ddd5191e9c472db9b482df20072e5ea4e7c5473f95
-  data.tar.gz: 764369b4f40ff33aaf2576721d58fafe54a7bda777e00e84387b008a3a9d006a
+  metadata.gz: 86ac16bd9cd3c64cd98305a6423e67c05187040d8caba798d132a4f985ee28df
+  data.tar.gz: 8da24e90611e20296f70ca3cadab5a77f697c97ff43cf535b9f51b1bd40a66be
 SHA512:
-  metadata.gz: f0fa13de63f9418c5acec24af7e645927ee502e63401e36288b4d478e8d17d5d41bfe762e4055dc9fe67915c6b466d755a61ceb885a9f0c9e31d4d8a6abe4f23
-  data.tar.gz: a4c00a408fced68c41d503711ee5204df1bd978d14fe0b5b9a02a6d53e3b54a1a8381a930b87c86c5cd67ce239711a7b002e8931bcb184edab2f2fb1b1849e3d
+  metadata.gz: c573a9265e4558a9d502840cb7b65b0c07c6e6f640c74bde499ed1b4ff160fd8aeb101a9ecd95b692a2170c812d0a6afd14d8abe8629d46b8e65732a7622384c
+  data.tar.gz: 53e55b8afcc5f32cd1b0fa238e0f7db356b4e919d57f606ebec37ee3a86539fff2dd0afaef3b5bf6f295f235e9f4452ec1b5bb3dee5dc7fd1df964cb3e6f3d85

data/CHANGELOG.md

@@ -53,3 +53,12 @@
 - Results include what is needed to revert: deleted branch SHAs, the previous branch after `checkout`, the previous commit after `reset`
 - Add `schema` command that prints the JSON Schema
 - Internal: new `Repo` service layer with `Branch` and `Commit` records; integration specs run against real temporary git repositories
+
+## [0.5.1] - 2026-10-04
+
+Security fixes for names and text that come from the repository:
+
+- `checkout` uses `git switch --` and refuses a branch name that starts with a dash. A local ref named like `--force` (for example from a cloned repository) used to become a `git checkout --force` option and discard uncommitted changes
+- Branch and default-branch detection use full ref names. A tag named like `origin/<default>` could change the short name of `origin/HEAD`, so the default branch lost its deletion protection and its merge status; `origin/HEAD` must now point inside `refs/remotes/origin/`
+- `delete` passes `--` before the branch name; `resolve_commit` refuses references that start with a dash
+- Text output shows terminal control characters of repository-controlled text (commit subjects, git errors) as escapes such as `\x1B`, so a crafted commit subject cannot move the cursor, rewrite output or set the clipboard (OSC 52). JSON output keeps the original text

data/lib/gitflash/branch.rb

@@ -11,7 +11,7 @@ module Gitflash
     # Parses one line produced with Repo::BRANCH_FORMAT.
     # `merged_names` is nil when merge status is unknown.
     def self.parse(line, default_branch: nil, merged_names: nil)
-      name, sha, head, upstream, track, date, author, subject = line.split(Repo::SEPARATOR, 8)
+      name, sha, head, upstream, track, date, author, subject = fields(line)
 
       new(
         name: name,
@@ -29,6 +29,15 @@ module Gitflash
       )
     end
 
+    # The record's fields; the full ref name is shortened by removing refs/heads/ only, because
+    # `refname:short` gives another name when a tag has the same name.
+    def self.fields(line)
+      fields = line.split(Repo::SEPARATOR, 8)
+      fields[0] = fields[0].delete_prefix(Repo::HEADS)
+      fields
+    end
+    private_class_method :fields
+
     alias_method :current?, :current
     alias_method :default?, :default
     alias_method :upstream_gone?, :upstream_gone

data/lib/gitflash/commit.rb

@@ -12,7 +12,7 @@ module Gitflash
     end
 
     def label
-      "#{sha} - #{subject}"
+      "#{sha} - #{TerminalText.safe(subject)}"
     end
 
     def to_h

data/lib/gitflash/repo.rb

@@ -6,12 +6,14 @@ module Gitflash
   class Repo
     SEPARATOR = "\x1f"
     BRANCH_FORMAT = %w[
-      refname:short objectname:short HEAD upstream:short upstream:track,nobracket
+      refname objectname:short HEAD upstream:short upstream:track,nobracket
       committerdate:iso-strict authorname subject
     ].map { |field| "%(#{field})" }.join('%1f')
     COMMIT_FORMAT = %w[%h %s %an %cI].join('%x1f')
     COMMITS_LIMIT = 100
     FALLBACK_DEFAULT_BRANCHES = %w[main master].freeze
+    HEADS = 'refs/heads/'
+    REMOTE_HEAD = 'refs/remotes/origin/'
 
     def initialize(bash: Git::BashCommand)
       @bash = bash
@@ -41,7 +43,7 @@ module Gitflash
     def default_branch
       return @default_branch if defined?(@default_branch)
 
-      @default_branch = default_ref&.delete_prefix('origin/')
+      @default_branch = branch_name(default_ref)
     end
 
     # Commits of the current branch, newest first. Empty for a branch without commits.
@@ -54,17 +56,22 @@ module Gitflash
 
     # Full sha of a commit reference, or nil when it does not name a commit
     def resolve_commit(ref)
+      return nil if ref.start_with?('-')
+
       stdout, _stderr, success = @bash.capture('git', 'rev-parse', '--verify', '--quiet',
                                                "#{ref}^{commit}")
       success ? stdout.strip : nil
     end
 
+    # Uses `git switch`, which never discards changes or treats the name as a file path.
+    # A name that starts with a dash is refused: a ref named like an option must not become one.
     def checkout(branch)
-      run('git', 'checkout', branch, '--')
+      refuse_option_like!(branch)
+      run('git', 'switch', '--', branch)
     end
 
     def delete_branch(branch, force: false)
-      run('git', 'branch', force ? '-D' : '-d', branch)
+      run('git', 'branch', force ? '-D' : '-d', '--', branch)
     end
 
     def reset(commit, mode:)
@@ -73,13 +80,27 @@ module Gitflash
 
     private
 
+    # Removes only the prefix the ref starts with, so a branch named `refs/heads/x` keeps its name
+    def branch_name(ref)
+      return nil unless ref
+
+      ref.delete_prefix(ref.start_with?(REMOTE_HEAD) ? REMOTE_HEAD : HEADS)
+    end
+
+    def refuse_option_like!(name)
+      return unless name.start_with?('-')
+
+      raise UsageError.new("Invalid branch name '#{name}'", code: 'invalid_usage')
+    end
+
     def branch_lines
       @branch_lines ||= @bash.exec('git', 'for-each-ref', "--format=#{BRANCH_FORMAT}",
-                                   'refs/heads/')
+                                   HEADS)
                              .each_line(chomp: true).reject(&:empty?)
     end
 
-    # Ref used to check merge status: origin/HEAD's target, else a local main/master
+    # Full ref used to check merge status: origin/HEAD's target, else a local main/master.
+    # Full names are used throughout because short names change when a tag has the same name.
     def default_ref
       return @default_ref if defined?(@default_ref)
 
@@ -87,24 +108,23 @@ module Gitflash
     end
 
     def remote_default_ref
-      ref = @bash.exec('git', 'symbolic-ref', '--quiet', '--short',
-                       'refs/remotes/origin/HEAD').strip
-      ref.empty? ? nil : ref
+      ref = @bash.exec('git', 'symbolic-ref', '--quiet', "#{REMOTE_HEAD}HEAD").strip
+      ref.start_with?(REMOTE_HEAD) ? ref : nil
     rescue Git::CommandError
       nil
     end
 
     def local_default_branch
-      names = branch_lines.map { |line| line.split(SEPARATOR, 2).first }
-      FALLBACK_DEFAULT_BRANCHES.find { |name| names.include?(name) }
+      names = branch_lines.map { |line| line.split(SEPARATOR, 2).first.delete_prefix(HEADS) }
+      name = FALLBACK_DEFAULT_BRANCHES.find { |candidate| names.include?(candidate) }
+      name && "#{HEADS}#{name}"
     end
 
     def merged_branch_names
       return nil unless default_ref
 
-      @bash.exec('git', 'for-each-ref', "--merged=#{default_ref}", '--format=%(refname:short)',
-                 'refs/heads/')
-           .each_line(chomp: true).to_set
+      @bash.exec('git', 'for-each-ref', "--merged=#{default_ref}", '--format=%(refname)', HEADS)
+           .each_line(chomp: true).to_set { |ref| ref.delete_prefix(HEADS) }
     end
 
     def run(*)

data/lib/gitflash/terminal_text.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Gitflash
+  # Makes text from the repository safe to print in a terminal. Commit subjects, author names
+  # and git messages are written by other people; control characters in them could move the
+  # cursor, rewrite earlier output or set the clipboard (OSC 52). They are shown as escapes.
+  # Newlines and tabs stay.
+  module TerminalText
+    UNSAFE = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/
+
+    module_function
+
+    def safe(text)
+      text.to_s.scrub.gsub(UNSAFE) do |char|
+        format(char.ord > 0xFF ? '\\u%04X' : '\\x%02X', char.ord)
+      end
+    end
+  end
+end

data/lib/gitflash/ui.rb

@@ -38,7 +38,7 @@ module Gitflash
         document = envelope(status: status, plan: plan, result: result, error: error)
         $stdout.puts JSON.generate(document)
       else
-        $stdout.puts text
+        $stdout.puts TerminalText.safe(text)
       end
       OK_STATUSES.include?(status) ? 0 : 1
     end
@@ -48,7 +48,7 @@ module Gitflash
         details = { code: error.code, message: error.message, exit_code: error.exit_code }
         $stdout.puts JSON.generate(envelope(status: error.status, plan: error.plan, error: details))
       else
-        warn error.message
+        warn TerminalText.safe(error.message)
       end
     end
 

data/lib/gitflash/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Gitflash
-  VERSION = '0.5.0'
+  VERSION = '0.5.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitflash
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Kleanthis Mitsioulis
@@ -89,6 +89,7 @@ files:
 - lib/gitflash/prompt.rb
 - lib/gitflash/repo.rb
 - lib/gitflash/result.rb
+- lib/gitflash/terminal_text.rb
 - lib/gitflash/ui.rb
 - lib/gitflash/usage_error.rb
 - lib/gitflash/version.rb
@@ -114,7 +115,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.22
 specification_version: 4
 summary: Simplified usage of some git cli commands
 test_files: []