GitPython 3.1.60__tar.gz → 3.1.62__tar.gz

{gitpython-3.1.60 → gitpython-3.1.62/GitPython.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GitPython
-Version: 3.1.60
+Version: 3.1.62
 Summary: GitPython is a Python library used to interact with Git repositories
 Home-page: https://github.com/gitpython-developers/GitPython
 Author: Sebastian Thiel, Michael Trier

{gitpython-3.1.60/GitPython.egg-info → gitpython-3.1.62}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GitPython
-Version: 3.1.60
+Version: 3.1.62
 Summary: GitPython is a Python library used to interact with Git repositories
 Home-page: https://github.com/gitpython-developers/GitPython
 Author: Sebastian Thiel, Michael Trier

gitpython-3.1.62/VERSION

@@ -0,0 +1 @@
+3.1.62

{gitpython-3.1.60 → gitpython-3.1.62}/doc/source/changes.rst

@@ -2,6 +2,31 @@
 Changelog
 =========
 
+3.1.62
+======
+
+Security fixes for
+
+* https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-59cr-6r3x-644w
+
+If you can, also try and provide feedback on the upcoming v4 branch
+https://github.com/gitpython-developers/GitPython/pull/2177 - patches welcome.
+
+See the following for all changes.
+https://github.com/gitpython-developers/GitPython/releases/tag/3.1.62
+
+3.1.61
+======
+
+A fixup release to avoid accidental removal of public class regex on Actor.
+It's now deprecated instead.
+
+If you can, also try and provide feedback on the upcoming v4 branch
+https://github.com/gitpython-developers/GitPython/pull/2177 - patches welcome.
+
+See the following for all changes.
+https://github.com/gitpython-developers/GitPython/releases/tag/3.1.61
+
 3.1.60
 ======
 

{gitpython-3.1.60 → gitpython-3.1.62}/git/__init__.py

@@ -86,7 +86,7 @@ __all__ = [
     "to_hex_sha",
 ]
 
-__version__ = '3.1.60'
+__version__ = '3.1.62'
 
 from typing import Any, List, Optional, Sequence, TYPE_CHECKING, Tuple, Union
 

{gitpython-3.1.60 → gitpython-3.1.62}/git/config.py

@@ -467,6 +467,45 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
 
         # END string_decode
 
+        def is_line_continuation(value: str) -> bool:
+            quoted = escaped = False
+            for char in value:
+                if escaped:
+                    escaped = False
+                elif char == "\\":
+                    escaped = True
+                elif char == '"':
+                    quoted = not quoted
+                elif char in "#;" and not quoted:
+                    return False
+            return escaped
+
+        def parse_value(value: str) -> str:
+            parsed: List[str] = []
+            whitespace: List[str] = []
+            quoted = escaped = False
+            escapes = {"b": "\b", "n": "\n", "t": "\t", '"': '"', "\\": "\\"}
+            for char in value:
+                if escaped:
+                    parsed.append(escapes.get(char, "\\" + char))
+                    escaped = False
+                    continue
+                if char.isspace() and not quoted:
+                    if parsed:
+                        whitespace.append(char)
+                    continue
+                if char in "#;" and not quoted:
+                    break
+                parsed.extend(whitespace)
+                whitespace.clear()
+                if char == "\\":
+                    escaped = True
+                elif char == '"':
+                    quoted = not quoted
+                else:
+                    parsed.append(char)
+            return "".join(parsed)
+
         while True:
             # We assume to read binary!
             line = fp.readline().decode(defenc)
@@ -513,7 +552,29 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
 
                     if len(optval) < 2 or optval[0] != '"':
                         # Does not open quoting.
-                        pass
+                        # A value ending in an odd number of backslashes
+                        # continues on the next line, exactly as git does: the
+                        # final backslash and the newline are removed and the
+                        # next line is appended before the complete value is
+                        # parsed. An even number means the last backslash is
+                        # escaped and the value ends there.
+                        continued = False
+                        while True:
+                            if not is_line_continuation(optval):
+                                break
+                            continuation = fp.readline()
+                            if not continuation:
+                                # Backslash at end of file: git drops it.
+                                optval = optval[:-1]
+                                break
+                            lineno = lineno + 1
+                            joined = continuation.decode(defenc)
+                            while joined.endswith("\n") or joined.endswith("\r"):
+                                joined = joined[:-1]
+                            optval = optval[:-1] + joined
+                            continued = True
+                        if continued:
+                            optval = parse_value(optval)
                     elif optval[-1] != '"':
                         # Opens quoting and does not close: appears to start multi-line quoting.
                         is_multi_line = True

{gitpython-3.1.60 → gitpython-3.1.62}/git/objects/submodule/base.py

@@ -414,6 +414,18 @@ class Submodule(IndexObject, TraversableIterableObj):
 
         return path
 
+    @property
+    def abspath(self) -> PathLike:
+        root = self.repo.working_tree_dir
+        if root is None:
+            return super().abspath
+        path = root
+        for component in os.fspath(self._to_relative_path(self.repo, self.path)).split("/"):
+            path = join_path_native(path, component)
+            if osp.islink(path):
+                raise ValueError("Submodule checkout path %r contains a symbolic link" % self.path)
+        return path
+
     @classmethod
     def _write_git_file_and_module_config(cls, working_tree_dir: PathLike, module_abspath: PathLike) -> None:
         """Write a ``.git`` file containing a (preferably) relative path to the actual

{gitpython-3.1.60 → gitpython-3.1.62}/git/repo/base.py

@@ -386,6 +386,10 @@ class Repo:
             # Let's not assume the option exists, although it should.
             pass
 
+        # A linked worktree is not bare even when its main repository is.
+        if self._bare and self._working_tree_dir and osp.isfile(osp.join(self.git_dir, "commondir")):
+            self._bare = False
+
         # Adjust the working directory in case we are actually bare - we didn't know
         # that in the first place.
         if self._bare:

{gitpython-3.1.60 → gitpython-3.1.62}/git/util.py

@@ -80,6 +80,7 @@ from typing import (
     Sequence,
     Tuple,
     TYPE_CHECKING,
+    Type,
     TypeVar,
     Union,
     cast,
@@ -108,6 +109,7 @@ from git.types import (
 
 T_IterableObj = TypeVar("T_IterableObj", bound=Union["IterableObj", "Has_id_attribute"], covariant=True)
 # So IterableList[Head] is subtype of IterableList[IterableObj].
+T_Actor = TypeVar("T_Actor", bound="Actor")
 
 _logger = logging.getLogger(__name__)
 
@@ -853,11 +855,27 @@ class CallableRemoteProgress(RemoteProgress):
         self._callable(*args, **kwargs)
 
 
+class _DeprecatedActorNameEmailRegex:
+    _pattern = re.compile(r"(.*) <(.*?)>")
+
+    def __get__(self, _instance: Any, _owner: Any) -> Pattern[str]:
+        warnings.warn(
+            "Actor.name_email_regex is deprecated and will be removed in GitPython 4.0.0 because searching long "
+            "malformed strings with it can take quadratic time. Use Actor.from_string() to parse actor identities, "
+            "or Actor(name, email) when the fields are already separate.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        return self._pattern
+
+
 class Actor:
     """Actors hold information about a person acting on the repository. They can be
     committers and authors or anything with a name and an email as mentioned in the git
     log entries."""
 
+    name_email_regex = _DeprecatedActorNameEmailRegex()
+
     # ENVIRONMENT VARIABLES
     # These are read when creating new commits.
     env_author_name = "GIT_AUTHOR_NAME"
@@ -891,7 +909,7 @@ class Actor:
         return '<git.Actor "%s <%s>">' % (self.name, self.email)
 
     @classmethod
-    def _from_string(cls, string: str) -> "Actor":
+    def from_string(cls: Type[T_Actor], string: str) -> T_Actor:
         """Create an :class:`Actor` from a string.
 
         :param string:
@@ -906,10 +924,12 @@ class Actor:
         left_bracket = line.find("<")
         right_bracket = line.find(">", left_bracket + 1)
         if left_bracket >= 0 and right_bracket >= 0:
-            return Actor(line[:left_bracket].rstrip(), line[left_bracket + 1 : right_bracket])
+            return cls(line[:left_bracket].rstrip(), line[left_bracket + 1 : right_bracket])
 
         # Assume the best and use the whole string as name.
-        return Actor(string, None)
+        return cls(string, None)
+
+    _from_string = from_string
 
     @classmethod
     def _main_actor(

gitpython-3.1.60/VERSION

@@ -1 +0,0 @@
-3.1.60