Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also .

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also .
base repository: gitpython-developers/GitPython
base: 3.1.29
Choose a base ref
head repository: gitpython-developers/GitPython
compare: 3.1.30
Choose a head ref
  • 20 commits
  • 17 files changed
  • 7 contributors

Commits on Oct 14, 2022

  1. Merge pull request #1501 from SergeantMenacingGarlic/date_types

    Add datetime.datetime type to commit_date and author_date
    Byron committed Oct 14, 2022

Commits on Nov 28, 2022

  1. Bump cygwin/cygwin-install-action from 2 to 3

    Bumps [cygwin/cygwin-install-action](https://github.com/cygwin/cygwin-install-action) from 2 to 3.
    - [Release notes](https://github.com/cygwin/cygwin-install-action/releases)
    - [Commits](cygwin/cygwin-install-action@v2...v3)
    
    ---
    updated-dependencies:
    - dependency-name: cygwin/cygwin-install-action
      dependency-type: direct:production
      update-type: version-update:semver-major
    ...
    
    Signed-off-by: dependabot[bot] <[email protected]>
    dependabot[bot] authored and Byron committed Nov 28, 2022

Commits on Dec 21, 2022

  1. Fix command injection

    Add `--` in some commands that receive user input
    and if interpreted as options could lead to remote
    code execution (RCE).
    
    There may be more commands that could benefit from `--`
    so the input is never interpreted as an option,
    but most of those aren't dangerous.
    
    Fixed commands:
    
    - push
    - pull
    - fetch
    - clone/clone_from and friends
    - archive (not sure if this one can be exploited, but it doesn't hurt
      adding `--` :))
    
    For anyone using GitPython and exposing any of the GitPython methods to users,
    make sure to always validate the input (like if starts with `--`).
    And for anyone allowing users to pass arbitrary options, be aware
    that some options may lead fo RCE, like `--exc`, `--upload-pack`,
    `--receive-pack`, `--config` (#1516).
    
    Ref #1517
    stsewd committed Dec 21, 2022
  2. Fix CI

    Taken from #1516
    stsewd committed Dec 21, 2022

Commits on Dec 22, 2022

  1. Add test

    stsewd committed Dec 22, 2022
  2. update changelog

    Byron committed Dec 22, 2022

Commits on Dec 23, 2022

  1. Forbid unsafe protocol URLs in Repo.clone{,_from}()

    Since the URL is passed directly to git clone, and the remote-ext helper
    will happily execute shell commands, so by default disallow URLs that
    contain a "::" unless a new unsafe_protocols kwarg is passed.
    (CVE-2022-24439)
    
    Fixes #1515
    s-t-e-v-e-n-k authored and stsewd committed Dec 23, 2022

Commits on Dec 24, 2022

Commits on Dec 27, 2022

  1. Updates from review

    stsewd committed Dec 27, 2022

Commits on Dec 28, 2022

  1. More tests

    stsewd committed Dec 28, 2022
  2. Submodule tests

    stsewd committed Dec 28, 2022

Commits on Dec 29, 2022

  1. Updates from review

    stsewd committed Dec 29, 2022
  2. Document PushInfoList

    skinitimski authored and Byron committed Dec 29, 2022
  3. Fix type hint on create_tag

    pycharm yells at me without this
    drewcassidy authored and Byron committed Dec 29, 2022
  4. Merge pull request #1521 from stsewd/block-insecure-options

    Block insecure options and protocols by default
    Byron committed Dec 29, 2022