ReadBlob, ListTree, Archive, Grep and RevList in internal/gitutil pass user-influenced refs without a -- separator. Current mitigations hold: refs are glued to :path or ^{commit} and web handlers call ResolveRef first, so a leading-dash ref becomes a 404. It works by call-site convention; a future handler passing a raw ref as a standalone argument to an option-taking subcommand would be injectable (rev-list --output= is real).
Remedy: insert -- before ref and path arguments in gitutil once.
closed by commit 1030a916f9 by cmc: gitutil: end option parsing before every ref
2026-09-03 18:47 UTC