GitPython 3.1.50__tar.gz → 3.1.51__tar.gz

{gitpython-3.1.50 → gitpython-3.1.51}/AUTHORS

@@ -57,5 +57,6 @@ Contributors are:
 -Jonas Scharpf <jonas.scharpf _at_ checkmk.com>
 -Gordon Marx
 -Enji Cooper
+-Harshita Yadav <harshitayadav504 _at_ gmail.com>
 
 Portions derived from other open source works and are clearly marked.

gitpython-3.1.51/CONTRIBUTING.md

@@ -0,0 +1,46 @@
+# How to contribute
+
+The following is a short step-by-step rundown of what one typically would do to contribute.
+
+- [Fork this project](https://github.com/gitpython-developers/GitPython/fork) on GitHub.
+- For setting up the environment to run the self tests, please run `init-tests-after-clone.sh`.
+- Please try to **write a test that fails unless the contribution is present.**
+- Try to avoid massive commits and prefer to take small steps, with one commit for each.
+- Feel free to add yourself to AUTHORS file.
+- Create a pull request.
+
+## Quality expectations
+
+Contributions must be made with care and meet the quality bar of the surrounding code.
+That means a change should not leave GitPython worse than it was before: it should be
+readable, maintainable, tested where practical, documented and consistent with the
+existing style and behavior.
+
+A contribution that works only narrowly but lowers the quality of the
+codebase may be declined. The maintainers may not always be able to provide
+detailed feedback.
+
+## AI-assisted contributions
+
+If AI edits files for you, disclose it in the pull request description and commit
+metadata. Prefer making the agent identity part of the commit, for example by using
+an AI author such as `$agent $version <ai-agent@example.invalid>` or a co-author via
+a `Co-authored-by: <agent-identity>` trailer.
+
+Agents operating through a person's GitHub account must identify themselves. For
+example, comments posted by an agent should say so directly with phrases like
+`AI agent on behalf of <person>: ...`.
+
+Fully AI-generated comments on pull requests or issues must also be disclosed.
+Undisclosed AI-generated comments may lead to the pull request or issue being closed.
+
+AI-assisted proofreading or wording polish does not need disclosure, but it is still
+courteous to mention it when the AI materially influenced the final text.
+
+Automated or "full-auto" AI contributions without a human responsible for reviewing
+and standing behind the work may be closed.
+
+## Fuzzing Test Specific Documentation
+
+For details related to contributing to the fuzzing test suite and OSS-Fuzz integration, please 
+refer to the dedicated [fuzzing README](./fuzzing/README.md).

{gitpython-3.1.50 → gitpython-3.1.51/GitPython.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GitPython
-Version: 3.1.50
+Version: 3.1.51
 Summary: GitPython is a Python library used to interact with Git repositories
 Home-page: https://github.com/gitpython-developers/GitPython
 Author: Sebastian Thiel, Michael Trier

{gitpython-3.1.50/GitPython.egg-info → gitpython-3.1.51}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GitPython
-Version: 3.1.50
+Version: 3.1.51
 Summary: GitPython is a Python library used to interact with Git repositories
 Home-page: https://github.com/gitpython-developers/GitPython
 Author: Sebastian Thiel, Michael Trier

gitpython-3.1.51/VERSION

@@ -0,0 +1 @@
+3.1.51

{gitpython-3.1.50 → gitpython-3.1.51}/doc/source/changes.rst

@@ -2,6 +2,23 @@
 Changelog
 =========
 
+3.1.51
+======
+
+This is primarily a security release. It prevents additional argument-injection
+paths that could allow execution of arbitrary commands or writing to arbitrary
+files through unsafe Git options (GHSA-956x-8gvw-wg5v), and closes bypasses of
+the existing protections using abbreviated long options or joined short options
+(GHSA-2f96-g7mh-g2hx).
+
+The release also improves support for relative worktree paths and diffs against
+the empty tree, preserves stderr from failed diff processes, supports relative
+configuration include paths, and includes assorted documentation, typing, test,
+and CI improvements.
+
+See the following for all changes.
+https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51
+
 3.1.50
 ======
 

{gitpython-3.1.50 → gitpython-3.1.51}/git/__init__.py

@@ -86,7 +86,7 @@ __all__ = [
     "to_hex_sha",
 ]
 
-__version__ = '3.1.50'
+__version__ = '3.1.51'
 
 from typing import Any, List, Optional, Sequence, TYPE_CHECKING, Tuple, Union
 

{gitpython-3.1.50 → gitpython-3.1.51}/git/cmd.py

@@ -649,6 +649,11 @@ class Git(metaclass=_GitMeta):
 
     re_unsafe_protocol = re.compile(r"(.+)::.+")
 
+    unsafe_git_ls_remote_options = [
+        # This option allows arbitrary command execution in git-ls-remote.
+        "--upload-pack",
+    ]
+
     def __getstate__(self) -> Dict[str, Any]:
         return slots_to_dict(self, exclude=self._excluded_)
 
@@ -961,17 +966,80 @@ class Git(metaclass=_GitMeta):
 
     @classmethod
     def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:
-        """Check for unsafe options.
-
-        Some options that are passed to ``git <command>`` can be used to execute
-        arbitrary commands. These are blocked by default.
+        """Raise :class:`~git.exc.UnsafeOptionError` for blocked option spellings.
+
+        In addition to exact matches, this rejects abbreviated long options accepted
+        by Git (for example, ``--upl`` for ``--upload-pack``) and unsafe short options
+        whose values are joined to the same token, including after clusterable flags
+        (for example, ``-uVALUE`` and ``-fuVALUE``).
+
+        A list containing only bare names is treated as normalized keyword arguments,
+        so multi-character names such as ``upload_p`` are checked as long-option
+        abbreviations. If any item starts with ``-``, the list is treated as tokenized
+        command-line input: bare items can be option values and are not checked as
+        abbreviations. Thus ``["--origin", "upload"]`` is allowed. Single-dash options
+        use short-option parsing rather than broad prefix matching, preserving safe
+        attached values such as ``-oupstream`` and ``-bcurrent``.
+
+        Some options passed to ``git <command>`` can execute arbitrary commands and
+        are therefore blocked by default unless the caller explicitly allows them.
         """
         # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`.
+        # Git accepts any unambiguous prefix of a long option, so an abbreviated
+        # spelling such as `--upl` for `--upload-pack` must be rejected too. An
+        # option is unsafe if its canonical name is a prefix of any blocked
+        # option's canonical name. Only long options and multi-character kwargs
+        # can be abbreviations; single-character short options remain exact-match
+        # only.
         canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options}
+        unsafe_short_options = {
+            canonical: option
+            for canonical, option in canonical_unsafe_options.items()
+            if option.startswith("-") and not option.startswith("--") and len(canonical) == 1
+        }
+        # These value-less Git flags can be clustered before another short option
+        # (for example, ``-fuVALUE``). Stop at any other character because it may
+        # begin an attached value, as ``o`` does in the safe option ``-oupstream``.
+        clusterable_short_options = frozenset("46flnqsv")
+        options_are_kwargs = all(not option.startswith("-") for option in options)
         for option in options:
-            unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option))
+            candidate = cls._canonicalize_option_name(option)
+            if not candidate:
+                continue
+            unsafe_option = canonical_unsafe_options.get(candidate)
             if unsafe_option is not None:
                 raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.")
+            option_token = option.split("=", 1)[0].split(None, 1)[0]
+            if option_token.startswith("-") and not option_token.startswith("--"):
+                for option_char in option_token[1:]:
+                    unsafe_option = unsafe_short_options.get(option_char)
+                    if unsafe_option is not None:
+                        raise UnsafeOptionError(
+                            f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
+                        )
+                    if option_char not in clusterable_short_options:
+                        break
+            if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)):
+                continue
+            for canonical, unsafe_option in canonical_unsafe_options.items():
+                if canonical.startswith(candidate):
+                    raise UnsafeOptionError(
+                        f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
+                    )
+
+    @classmethod
+    def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[str, Any]] = None) -> List[str]:
+        """Collect possible option spellings before command-line transformation."""
+        options = [
+            option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith("-")
+        ]
+        if kwargs:
+            for key, value in kwargs.items():
+                values = value if isinstance(value, (list, tuple)) else (value,)
+                if any(value is True or (value is not False and value is not None) for value in values):
+                    key = str(key)
+                    options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}")
+        return options
 
     AutoInterrupt: TypeAlias = _AutoInterrupt
 
@@ -1030,6 +1098,22 @@ class Git(metaclass=_GitMeta):
 
         self._persistent_git_options = self.transform_kwargs(split_single_char_options=True, **kwargs)
 
+    def ls_remote(
+        self,
+        *args: Any,
+        allow_unsafe_options: bool = False,
+        **kwargs: Any,
+    ) -> Union[str, bytes, Tuple[int, Union[str, bytes], str], "Git.AutoInterrupt"]:
+        """List references in a remote repository.
+
+        :param allow_unsafe_options:
+            Allow unsafe options, like ``--upload-pack``.
+        """
+        if not allow_unsafe_options:
+            candidate_options = self._option_candidates(args, kwargs)
+            Git.check_unsafe_options(options=candidate_options, unsafe_options=self.unsafe_git_ls_remote_options)
+        return self._call_process("ls_remote", *args, **kwargs)
+
     @property
     def working_dir(self) -> Union[None, PathLike]:
         """:return: Git directory we are working on"""
@@ -1131,9 +1215,28 @@ class Git(metaclass=_GitMeta):
         information (stdout).
 
         :param command:
-            The command argument list to execute.
-            It should be a sequence of program arguments, or a string. The
-            program to execute is the first item in the args sequence or string.
+            The command to execute. A sequence of program arguments is recommended.
+            A string is also accepted, but its meaning is strongly platform-dependent.
+
+            By default, a shell is not used. On Unix-like systems, a string is the whole
+            program name (so ``"git log -n 1"`` raises :class:`GitCommandNotFound`). On
+            Windows, the program parses the arguments itself, so multi-word strings can
+            work but are not portable.
+
+            Avoid ``shell=True`` (and :attr:`Git.USE_SHELL`): this runs the command in
+            a shell, which is generally unsafe. The shell interprets metacharacters
+            such as ``;``, ``|``, ``&``, ``$(...)``, ``$VAR``, ``%VAR%``, and ``^``
+            (depending on the platform) as syntax. Any untrusted text in the command
+            can then execute arbitrary OS commands. See :attr:`Git.USE_SHELL`.
+
+            Producing a sequence automatically by :func:`shlex.split` and passing it
+            as the command is far safer than ``shell=True``. But :func:`shlex.split`
+            parses POSIX shell syntax on all systems, and the result is still unsafe
+            for anything but *fixed, fully trusted* strings. Do not use it on strings
+            built by interpolating values: whitespace or quoting in an untrusted value
+            can still inject arguments. For input derived in any way from untrusted
+            data, build the argument sequence yourself, while ensuring each argument
+            is fully sanitized.
 
         :param istream:
             Standard input filehandle passed to :class:`subprocess.Popen`.
@@ -1201,6 +1304,11 @@ class Git(metaclass=_GitMeta):
             needed (nor useful) to work around any known operating system specific
             issues.
 
+            On Unix-like systems, when migrating away from passing string commands with
+            ``shell=True``, :func:`shlex.split` may serve as a transitional step in rare
+            cases, with extreme care. (Drop ``shell=True`` and pass the resulting
+            sequence as the command.) See the `command` parameter above on the risks.
+
         :param env:
             A dictionary of environment variables to be passed to
             :class:`subprocess.Popen`.
@@ -1512,7 +1620,7 @@ class Git(metaclass=_GitMeta):
         return args
 
     @classmethod
-    def _unpack_args(cls, arg_list: Sequence[str]) -> List[str]:
+    def _unpack_args(cls, arg_list: Sequence[Any]) -> List[str]:
         outlist = []
         if isinstance(arg_list, (list, tuple)):
             for arg in arg_list:
@@ -1588,7 +1696,7 @@ class Git(metaclass=_GitMeta):
 
         turns into::
 
-            git rev-list --max-count=10 --header=master
+            git rev-list --max-count=10 --header master
 
         :return:
             Same as :meth:`execute`. If no args are given, used :meth:`execute`'s

{gitpython-3.1.50 → gitpython-3.1.51}/git/config.py

@@ -634,6 +634,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
             files_to_read = list(self._file_or_files)
         # END ensure we have a copy of the paths to handle
 
+        files_to_read = [osp.abspath(path) if isinstance(path, (str, os.PathLike)) else path for path in files_to_read]
+
         seen = set(files_to_read)
         num_read_include_files = 0
         while files_to_read:

{gitpython-3.1.50 → gitpython-3.1.51}/git/diff.py

@@ -3,7 +3,7 @@
 # This module is part of GitPython and is released under the
 # 3-Clause BSD License: https://opensource.org/license/bsd-3-clause/
 
-__all__ = ["DiffConstants", "NULL_TREE", "INDEX", "Diffable", "DiffIndex", "Diff"]
+__all__ = ["DiffConstants", "NULL_TREE", "NULL_TREE_SHA", "INDEX", "Diffable", "DiffIndex", "Diff"]
 
 import enum
 import re
@@ -84,6 +84,9 @@ This is an alias of :const:`DiffConstants.NULL_TREE`, which may also be accessed
 :const:`git.NULL_TREE` and :const:`Diffable.NULL_TREE`.
 """
 
+NULL_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904"
+"""SHA of Git's canonical empty tree object."""
+
 INDEX: Literal[DiffConstants.INDEX] = DiffConstants.INDEX
 """Stand-in indicating you want to diff against the index.
 
@@ -599,7 +602,14 @@ class Diff:
 
         # FIXME: Here SLURPING raw, need to re-phrase header-regexes linewise.
         text_list: List[bytes] = []
-        handle_process_output(proc, text_list.append, None, finalize_process, decode_streams=False)
+        stderr_list: List[bytes] = []
+
+        def finalize_process_with_stderr(proc: Union["Popen", "Git.AutoInterrupt"]) -> None:
+            finalize_process(proc, stderr=b"".join(stderr_list))
+
+        handle_process_output(
+            proc, text_list.append, stderr_list.append, finalize_process_with_stderr, decode_streams=False
+        )
 
         # For now, we have to bake the stream.
         text = b"".join(text_list)
@@ -765,11 +775,16 @@ class Diff:
         # :100644 100644 687099101... 37c5e30c8... M    .gitignore
 
         index: "DiffIndex" = DiffIndex()
+        stderr_list: List[bytes] = []
+
+        def finalize_process_with_stderr(proc: Union["Popen", "Git.AutoInterrupt"]) -> None:
+            finalize_process(proc, stderr=b"".join(stderr_list))
+
         handle_process_output(
             proc,
             lambda byt: cls._handle_diff_line(byt, repo, index),
-            None,
-            finalize_process,
+            stderr_list.append,
+            finalize_process_with_stderr,
             decode_streams=False,
         )
 

{gitpython-3.1.50 → gitpython-3.1.51}/git/index/base.py

@@ -1480,12 +1480,11 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
 
         return self
 
-    # FIXME: This is documented to accept the same parameters as Diffable.diff, but this
-    # does not handle NULL_TREE for `other`. (The suppressed mypy error is about this.)
     def diff(
         self,
-        other: Union[  # type: ignore[override]
+        other: Union[
             Literal[git_diff.DiffConstants.INDEX],
+            Literal[git_diff.DiffConstants.NULL_TREE],
             "Tree",
             "Commit",
             str,
@@ -1512,6 +1511,44 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
         if other is self.INDEX:
             return git_diff.DiffIndex()
 
+        if other == git_diff.NULL_TREE or other == git_diff.NULL_TREE_SHA:
+            args: List[Union[PathLike, str]] = [
+                "--cached",
+                git_diff.NULL_TREE_SHA,
+                "--abbrev=40",
+                "--full-index",
+            ]
+
+            if not any(x in kwargs for x in ("find_renames", "no_renames", "M")):
+                args.append("-M")
+
+            if create_patch:
+                args.append("-p")
+                args.append("--no-ext-diff")
+            else:
+                args.append("--raw")
+                args.append("-z")
+
+            args.append("--no-color")
+
+            if paths is not None and not isinstance(paths, (tuple, list)):
+                paths = [paths]
+
+            if paths:
+                args.append("--")
+                args.extend(paths)
+
+            kwargs["as_process"] = True
+            proc = self.repo.git.diff(*args, **kwargs)
+
+            diff_method = (
+                git_diff.Diff._index_from_patch_format if create_patch else git_diff.Diff._index_from_raw_format
+            )
+            index = diff_method(self.repo, proc)
+
+            proc.wait()
+            return index
+
         # Index against anything but None is a reverse diff with the respective item.
         # Handle existing -R flags properly.
         # Transform strings to the object so that we can call diff on it.

{gitpython-3.1.50 → gitpython-3.1.51}/git/objects/commit.py

@@ -86,6 +86,12 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable):
     # INVARIANTS
     default_encoding = "UTF-8"
 
+    # Options to :manpage:`git-rev-list(1)` that can overwrite files.
+    unsafe_git_rev_options = [
+        "--output",
+        "-o",
+    ]
+
     type: Literal["commit"] = "commit"
 
     __slots__ = (
@@ -302,6 +308,7 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable):
         repo: "Repo",
         rev: Union[str, "Commit", "SymbolicReference"],
         paths: Union[PathLike, Sequence[PathLike]] = "",
+        allow_unsafe_options: bool = False,
         **kwargs: Any,
     ) -> Iterator["Commit"]:
         R"""Find all commits matching the given criteria.
@@ -330,6 +337,11 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable):
             raise ValueError("--pretty cannot be used as parsing expects single sha's only")
         # END handle pretty
 
+        if not allow_unsafe_options:
+            Git.check_unsafe_options(
+                options=Git._option_candidates([rev], kwargs), unsafe_options=cls.unsafe_git_rev_options
+            )
+
         # Use -- in all cases, to prevent possibility of ambiguous arguments.
         # See https://github.com/gitpython-developers/GitPython/issues/264.
 
@@ -374,6 +386,11 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable):
         """Create a git stat from changes between this commit and its first parent
         or from all changes done if this is the very first commit.
 
+        :note:
+            If this commit is at the boundary of a shallow clone, this will
+            raise :exc:`~git.exc.GitCommandError`, since the parent object
+            was never fetched and only exists as a reference on this commit.
+
         :return:
             :class:`Stats`
         """

{gitpython-3.1.50 → gitpython-3.1.51}/git/remote.py

@@ -517,6 +517,9 @@ class FetchInfo(IterableObj):
         raise NotImplementedError
 
 
+Progress = Union[RemoteProgress, "UpdateProgress", Callable[..., RemoteProgress], None]
+
+
 class Remote(LazyMixin, IterableObj):
     """Provides easy read and write access to a git remote.
 
@@ -872,7 +875,7 @@ class Remote(LazyMixin, IterableObj):
     def _get_fetch_info_from_stderr(
         self,
         proc: "Git.AutoInterrupt",
-        progress: Union[Callable[..., Any], RemoteProgress, None],
+        progress: Progress,
         kill_after_timeout: Union[None, float] = None,
     ) -> IterableList["FetchInfo"]:
         progress = to_progress_instance(progress)
@@ -1000,7 +1003,7 @@ class Remote(LazyMixin, IterableObj):
     def fetch(
         self,
         refspec: Union[str, List[str], None] = None,
-        progress: Union[RemoteProgress, None, "UpdateProgress"] = None,
+        progress: Progress = None,
         verbose: bool = True,
         kill_after_timeout: Union[None, float] = None,
         allow_unsafe_protocols: bool = False,
@@ -1068,7 +1071,10 @@ class Remote(LazyMixin, IterableObj):
                     Git.check_unsafe_protocols(ref)
 
         if not allow_unsafe_options:
-            Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_fetch_options)
+            Git.check_unsafe_options(
+                options=Git._option_candidates([], kwargs),
+                unsafe_options=self.unsafe_git_fetch_options,
+            )
 
         proc = self.repo.git.fetch(
             "--", self, *args, as_process=True, with_stdout=False, universal_newlines=True, v=verbose, **kwargs
@@ -1081,7 +1087,7 @@ class Remote(LazyMixin, IterableObj):
     def pull(
         self,
         refspec: Union[str, List[str], None] = None,
-        progress: Union[RemoteProgress, "UpdateProgress", None] = None,
+        progress: Progress = None,
         kill_after_timeout: Union[None, float] = None,
         allow_unsafe_protocols: bool = False,
         allow_unsafe_options: bool = False,
@@ -1122,7 +1128,10 @@ class Remote(LazyMixin, IterableObj):
                 Git.check_unsafe_protocols(ref)
 
         if not allow_unsafe_options:
-            Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_pull_options)
+            Git.check_unsafe_options(
+                options=Git._option_candidates([], kwargs),
+                unsafe_options=self.unsafe_git_pull_options,
+            )
 
         proc = self.repo.git.pull(
             "--", self, refspec, with_stdout=False, as_process=True, universal_newlines=True, v=True, **kwargs
@@ -1135,7 +1144,7 @@ class Remote(LazyMixin, IterableObj):
     def push(
         self,
         refspec: Union[str, List[str], None] = None,
-        progress: Union[RemoteProgress, "UpdateProgress", Callable[..., RemoteProgress], None] = None,
+        progress: Progress = None,
         kill_after_timeout: Union[None, float] = None,
         allow_unsafe_protocols: bool = False,
         allow_unsafe_options: bool = False,
@@ -1195,7 +1204,10 @@ class Remote(LazyMixin, IterableObj):
                 Git.check_unsafe_protocols(ref)
 
         if not allow_unsafe_options:
-            Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_push_options)
+            Git.check_unsafe_options(
+                options=Git._option_candidates([], kwargs),
+                unsafe_options=self.unsafe_git_push_options,
+            )
 
         proc = self.repo.git.push(
             "--",

{gitpython-3.1.50 → gitpython-3.1.51}/git/repo/base.py

@@ -161,6 +161,20 @@ class Repo:
     https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---configltkeygtltvaluegt
     """
 
+    unsafe_git_archive_options = [
+        # Allows arbitrary command execution through the remote git-upload-archive command.
+        "--exec",
+        # Writes output to a caller-controlled filesystem path.
+        "--output",
+        "-o",
+    ]
+
+    unsafe_git_revision_options = [
+        # This option allows output to be written to arbitrary files before revision parsing.
+        "--output",
+        "-o",
+    ]
+
     # Invariants
     config_level: ConfigLevels_Tup = ("system", "user", "global", "repository")
     """Represents the configuration level of a configuration file."""
@@ -295,7 +309,8 @@ class Repo:
                 sm_gitpath = find_worktree_git_dir(dotgit)
 
             if sm_gitpath is not None:
-                git_dir = expand_path(sm_gitpath, expand_vars)
+                # worktrees can use relative paths as of Git 2.48, so we join to curpath
+                git_dir = osp.normpath(osp.join(curpath, sm_gitpath))
                 self._working_tree_dir = curpath
                 break
 
@@ -774,6 +789,7 @@ class Repo:
         self,
         rev: Union[str, Commit, "SymbolicReference", None] = None,
         paths: Union[PathLike, Sequence[PathLike]] = "",
+        allow_unsafe_options: bool = False,
         **kwargs: Any,
     ) -> Iterator[Commit]:
         """An iterator of :class:`~git.objects.commit.Commit` objects representing the
@@ -791,6 +807,9 @@ class Repo:
             Arguments to be passed to :manpage:`git-rev-list(1)`.
             Common ones are ``max_count`` and ``skip``.
 
+        :param allow_unsafe_options:
+            Allow unsafe options in the revision argument, like ``--output``.
+
         :note:
             To receive only commits between two named revisions, use the
             ``"revA...revB"`` revision specifier.
@@ -801,7 +820,18 @@ class Repo:
         if rev is None:
             rev = self.head.commit
 
-        return Commit.iter_items(self, rev, paths, **kwargs)
+        if not allow_unsafe_options:
+            Git.check_unsafe_options(
+                options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options
+            )
+
+        return Commit.iter_items(
+            self,
+            rev,
+            paths,
+            allow_unsafe_options=allow_unsafe_options,
+            **kwargs,
+        )
 
     def merge_base(self, *rev: TBD, **kwargs: Any) -> List[Commit]:
         R"""Find the closest common ancestor for the given revision
@@ -1078,7 +1108,9 @@ class Repo:
             )
         return active_branch
 
-    def blame_incremental(self, rev: str | HEAD | None, file: str, **kwargs: Any) -> Iterator["BlameEntry"]:
+    def blame_incremental(
+        self, rev: str | HEAD | None, file: str, allow_unsafe_options: bool = False, **kwargs: Any
+    ) -> Iterator["BlameEntry"]:
         """Iterator for blame information for the given file at the given revision.
 
         Unlike :meth:`blame`, this does not return the actual file's contents, only a
@@ -1089,6 +1121,9 @@ class Repo:
             uncommitted changes. Otherwise, anything successfully parsed by
             :manpage:`git-rev-parse(1)` is a valid option.
 
+        :param allow_unsafe_options:
+            Allow unsafe options in revision argument, like ``--output``.
+
         :return:
             Lazy iterator of :class:`BlameEntry` tuples, where the commit indicates the
             commit to blame for the line, and range indicates a span of line numbers in
@@ -1097,6 +1132,10 @@ class Repo:
         If you combine all line number ranges outputted by this command, you should get
         a continuous range spanning all line numbers in the file.
         """
+        if not allow_unsafe_options:
+            Git.check_unsafe_options(
+                options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options
+            )
 
         data: bytes = self.git.blame(rev, "--", file, p=True, incremental=True, stdout_as_string=False, **kwargs)
         commits: Dict[bytes, Commit] = {}
@@ -1175,7 +1214,8 @@ class Repo:
         rev: Union[str, HEAD, None],
         file: str,
         incremental: bool = False,
-        rev_opts: Optional[List[str]] = None,
+        rev_opts: Optional[Sequence[str]] = None,
+        allow_unsafe_options: bool = False,
         **kwargs: Any,
     ) -> List[List[Commit | List[str | bytes] | None]] | Iterator[BlameEntry] | None:
         """The blame information for the given file at the given revision.
@@ -1185,6 +1225,9 @@ class Repo:
             uncommitted changes. Otherwise, anything successfully parsed by
             :manpage:`git-rev-parse(1)` is a valid option.
 
+        :param allow_unsafe_options:
+            Allow unsafe options in revision argument, like ``--output``.
+
         :return:
             list: [git.Commit, list: [<line>]]
 
@@ -1194,9 +1237,14 @@ class Repo:
             appearance.
         """
         if incremental:
-            return self.blame_incremental(rev, file, **kwargs)
-        rev_opts = rev_opts or []
-        data: bytes = self.git.blame(rev, *rev_opts, "--", file, p=True, stdout_as_string=False, **kwargs)
+            return self.blame_incremental(rev, file, allow_unsafe_options=allow_unsafe_options, **kwargs)
+        rev_opts_list = list(rev_opts or [])
+        if not allow_unsafe_options:
+            Git.check_unsafe_options(
+                options=Git._option_candidates([rev, rev_opts_list], kwargs),
+                unsafe_options=self.unsafe_git_revision_options,
+            )
+        data: bytes = self.git.blame(rev, *rev_opts_list, "--", file, p=True, stdout_as_string=False, **kwargs)
         commits: Dict[str, Commit] = {}
         blames: List[List[Commit | List[str | bytes] | None]] = []
 
@@ -1407,7 +1455,10 @@ class Repo:
         if not allow_unsafe_protocols:
             Git.check_unsafe_protocols(url)
         if not allow_unsafe_options:
-            Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=cls.unsafe_git_clone_options)
+            Git.check_unsafe_options(
+                options=Git._option_candidates([], kwargs),
+                unsafe_options=cls.unsafe_git_clone_options,
+            )
         if not allow_unsafe_options and multi:
             Git.check_unsafe_options(options=multi, unsafe_options=cls.unsafe_git_clone_options)
 
@@ -1582,6 +1633,8 @@ class Repo:
         ostream: Union[TextIO, BinaryIO],
         treeish: Optional[str] = None,
         prefix: Optional[str] = None,
+        allow_unsafe_options: bool = False,
+        allow_unsafe_protocols: bool = False,
         **kwargs: Any,
     ) -> Repo:
         """Archive the tree at the given revision.
@@ -1604,6 +1657,12 @@ class Repo:
               repository-relative path to a directory or file to place into the archive,
               or a list or tuple of multiple paths.
 
+        :param allow_unsafe_options:
+            Allow unsafe options, like ``--exec`` or ``--output``.
+
+        :param allow_unsafe_protocols:
+            Allow unsafe protocols to be used in ``remote``, like ``ext``.
+
         :raise git.exc.GitCommandError:
             If something went wrong.
 
@@ -1614,6 +1673,14 @@ class Repo:
             treeish = self.head.commit
         if prefix and "prefix" not in kwargs:
             kwargs["prefix"] = prefix
+        remote = kwargs.get("remote")
+        if not allow_unsafe_protocols and remote is not None:
+            Git.check_unsafe_protocols(str(remote))
+        if not allow_unsafe_options:
+            Git.check_unsafe_options(
+                options=Git._option_candidates([], kwargs),
+                unsafe_options=self.unsafe_git_archive_options,
+            )
         kwargs["output_stream"] = ostream
         path = kwargs.pop("path", [])
         path = cast(Union[PathLike, List[PathLike], Tuple[PathLike, ...]], path)

gitpython-3.1.50/CONTRIBUTING.md

@@ -1,15 +0,0 @@
-# How to contribute
-
-The following is a short step-by-step rundown of what one typically would do to contribute.
-
-- [Fork this project](https://github.com/gitpython-developers/GitPython/fork) on GitHub.
-- For setting up the environment to run the self tests, please run `init-tests-after-clone.sh`.
-- Please try to **write a test that fails unless the contribution is present.**
-- Try to avoid massive commits and prefer to take small steps, with one commit for each.
-- Feel free to add yourself to AUTHORS file.
-- Create a pull request.
-
-## Fuzzing Test Specific Documentation
-
-For details related to contributing to the fuzzing test suite and OSS-Fuzz integration, please 
-refer to the dedicated [fuzzing README](./fuzzing/README.md).

gitpython-3.1.50/VERSION

@@ -1 +0,0 @@
-3.1.50