GitPython 3.1.53__tar.gz → 3.1.54__tar.gz

{gitpython-3.1.53 → gitpython-3.1.54/GitPython.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GitPython
-Version: 3.1.53
+Version: 3.1.54
 Summary: GitPython is a Python library used to interact with Git repositories
 Home-page: https://github.com/gitpython-developers/GitPython
 Author: Sebastian Thiel, Michael Trier

{gitpython-3.1.53/GitPython.egg-info → gitpython-3.1.54}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GitPython
-Version: 3.1.53
+Version: 3.1.54
 Summary: GitPython is a Python library used to interact with Git repositories
 Home-page: https://github.com/gitpython-developers/GitPython
 Author: Sebastian Thiel, Michael Trier

gitpython-3.1.54/VERSION

@@ -0,0 +1 @@
+3.1.54

{gitpython-3.1.53 → gitpython-3.1.54}/doc/source/changes.rst

@@ -2,6 +2,21 @@
 Changelog
 =========
 
+3.1.54
+======
+
+A security fix for
+
+* https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3
+* https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf
+* https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc#event-857190
+
+If you can, also try and provide feedback on the upcoming v4 branch
+https://github.com/gitpython-developers/GitPython/pull/2177 - patches welcome.
+
+See the following for all changes.
+https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54
+
 3.1.53
 ======
 

{gitpython-3.1.53 → gitpython-3.1.54}/git/__init__.py

@@ -86,7 +86,7 @@ __all__ = [
     "to_hex_sha",
 ]
 
-__version__ = '3.1.53'
+__version__ = '3.1.54'
 
 from typing import Any, List, Optional, Sequence, TYPE_CHECKING, Tuple, Union
 

{gitpython-3.1.53 → gitpython-3.1.54}/git/cmd.py

@@ -1039,11 +1039,18 @@ class Git(metaclass=_GitMeta):
             option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith("-")
         ]
         if kwargs:
+            split_single_char_options = kwargs.get("split_single_char_options", True)
             for key, value in kwargs.items():
                 values = value if isinstance(value, (list, tuple)) else (value,)
                 if any(value is True or (value is not False and value is not None) for value in values):
                     key = str(key)
                     options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}")
+                    if len(key) == 1 and split_single_char_options:
+                        options.extend(
+                            str(value)
+                            for value in values
+                            if value is not True and value not in (False, None) and str(value).startswith("-")
+                        )
         return options
 
     AutoInterrupt: TypeAlias = _AutoInterrupt

{gitpython-3.1.53 → gitpython-3.1.54}/git/diff.py

@@ -9,7 +9,7 @@ import enum
 import re
 import warnings
 
-from git.cmd import handle_process_output
+from git.cmd import Git, handle_process_output
 from git.compat import defenc
 from git.objects.blob import Blob
 from git.objects.util import mode_str_to_int
@@ -35,7 +35,6 @@ from git.types import PathLike, Literal
 if TYPE_CHECKING:
     from subprocess import Popen
 
-    from git.cmd import Git
     from git.objects.base import IndexObject
     from git.objects.commit import Commit
     from git.objects.tree import Tree
@@ -190,6 +189,7 @@ class Diffable:
         other: Union[DiffConstants, "Tree", "Commit", str, None] = INDEX,
         paths: Union[PathLike, List[PathLike], Tuple[PathLike, ...], None] = None,
         create_patch: bool = False,
+        allow_unsafe_options: bool = False,
         **kwargs: Any,
     ) -> "DiffIndex[Diff]":
         """Create diffs between two items being trees, trees and index or an index and
@@ -219,6 +219,10 @@ class Diffable:
             applied makes the self to other. Patches are somewhat costly as blobs have
             to be read and diffed.
 
+        :param allow_unsafe_options:
+            If ``True``, allow options such as ``--output`` that can write to arbitrary
+            filesystem paths.
+
         :param kwargs:
             Additional arguments passed to :manpage:`git-diff(1)`, such as ``R=True`` to
             swap both sides of the diff.
@@ -231,6 +235,12 @@ class Diffable:
             an instance of :class:`~git.objects.tree.Tree` or
             :class:`~git.objects.commit.Commit`, or a git command error will occur.
         """
+        if not allow_unsafe_options:
+            Git.check_unsafe_options(
+                options=Git._option_candidates([other], kwargs),
+                unsafe_options=self.repo.unsafe_git_revision_options,
+            )
+
         args: List[Union[PathLike, Diffable]] = []
         args.append("--abbrev=40")  # We need full shas.
         args.append("--full-index")  # Get full index paths, not only filenames.

{gitpython-3.1.53 → gitpython-3.1.54}/git/index/base.py

@@ -23,6 +23,7 @@ from gitdb.base import IStream
 from gitdb.db import MemoryDB
 
 from git.compat import defenc, force_bytes
+from git.cmd import Git
 import git.diff as git_diff
 from git.exc import CheckoutError, GitCommandError, GitError, InvalidGitRepositoryError
 from git.objects import Blob, Commit, Object, Submodule, Tree
@@ -1492,6 +1493,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
         ] = git_diff.INDEX,
         paths: Union[PathLike, List[PathLike], Tuple[PathLike, ...], None] = None,
         create_patch: bool = False,
+        allow_unsafe_options: bool = False,
         **kwargs: Any,
     ) -> git_diff.DiffIndex[git_diff.Diff]:
         """Diff this index against the working copy or a :class:`~git.objects.tree.Tree`
@@ -1504,6 +1506,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
             Will only work with indices that represent the default git index as they
             have not been initialized with a stream.
         """
+        if not allow_unsafe_options:
+            Git.check_unsafe_options(
+                options=Git._option_candidates([other], kwargs),
+                unsafe_options=self.repo.unsafe_git_revision_options,
+            )
+
         # Only run if we are the default repository index.
         if self._file_path != self._index_path():
             raise AssertionError("Cannot call %r on indices that do not represent the default git index" % self.diff())
@@ -1560,7 +1568,13 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
             # Invert the existing R flag.
             cur_val = kwargs.get("R", False)
             kwargs["R"] = not cur_val
-            return other.diff(self.INDEX, paths, create_patch, **kwargs)
+            return other.diff(
+                self.INDEX,
+                paths,
+                create_patch,
+                allow_unsafe_options=allow_unsafe_options,
+                **kwargs,
+            )
         # END diff against other item handling
 
         # If other is not None here, something is wrong.
@@ -1568,4 +1582,4 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
             raise ValueError("other must be None, Diffable.INDEX, a Tree or Commit, was %r" % other)
 
         # Diff against working copy - can be handled by superclass natively.
-        return super().diff(other, paths, create_patch, **kwargs)
+        return super().diff(other, paths, create_patch, allow_unsafe_options=allow_unsafe_options, **kwargs)

{gitpython-3.1.53 → gitpython-3.1.54}/git/repo/base.py

@@ -149,6 +149,8 @@ class Repo:
         # Can override configuration variables that execute arbitrary commands:
         "--config",
         "-c",
+        # Can install hooks that execute during clone:
+        "--template",
     ]
     """Options to :manpage:`git-clone(1)` that allow arbitrary commands to be executed.
 
@@ -159,6 +161,9 @@ class Repo:
     The ``--config``/``-c`` option allows users to override configuration variables like
     ``protocol.allow`` and ``core.gitProxy`` to execute arbitrary commands:
     https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---configltkeygtltvaluegt
+
+    The ``--template`` option can install hooks that execute during clone:
+    https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---templatetemplate-directory
     """
 
     unsafe_git_archive_options = [

gitpython-3.1.53/VERSION

@@ -1 +0,0 @@
-3.1.53