Git's --end-of-options Flag and Security Implications
A critical flag discovery for Git command-line security.
1Discovery of --end-of-options in Git
The --end-of-options flag, introduced in Git 2.24.0, was designed to secure command-line argument processing. Unlike the traditional Unix -- marker, this flag is used to separate revisions and pathspecs in Git.
2Risk of Argument Injection
Tools like Git, hg, and ssh offer options to execute user-defined commands. These features can lead to malicious argument injection. Known as CWE-88, this security flaw occurs directly via the argv array without shell involvement.
3Security Vulnerabilities in Package Managers
Many package managers pass Git URLs and references to subprocesses. Those lacking protection against argument injection may face CVEs. Tools like Bundler, Composer, and Poetry have encountered such vulnerabilities.
4Git's Historical Behavior
Git repurposed the -- marker to separate revisions from pathspecs. This left the revision position without a terminator. The --end-of-options flag was introduced to eliminate this ambiguity.
5Correct Usage of the Flag
To safely pass an untrusted revision, use git log --end-of-options "$rev" -- "$path". This ensures both markers perform their separate roles effectively.
6Subcommand Support
Support for --end-of-options wasn't added to all Git subcommands at once. For instance, git rev-parse only gained support in version 2.30.0. git checkout and git reset rejected it until version 2.43.1.
7Package Manager Fixes
Most package managers don't use --end-of-options when forking Git subprocesses. Go's cmd/go is the sole exception. Others rely on the -- marker or leading-dash checks.
8Future Precautions
Git and other tools need more structural changes to prevent argument injection. For now, the --end-of-options flag plays a critical role in mitigating such vulnerabilities. Proper usage by developers is paramount.
Original article: Hacker News — Git'in --end-of-options Bayrağı ve Güvenlik Etkileri