Repository navigation
docs(security): clarify command wrapper responsibilities - #2342
Merged
Merged
Conversation
<!-- agent --> The threat model did not distinguish direct Git command access from higher-level library operations. This left file reads explicitly requested through raw command options liable to be mistaken for unwanted side effects of a higher-level method. Document `git.cmd.Git` and `repo.git` as command wrappers that do what the caller requests, including the effects of supplied options. Use `pathspec_from_file` to illustrate how a requested file read can also appear in Git's diagnostics. Explain the application's responsibility for exposing raw commands and errors to untrusted callers. Distinguish these calls from the protections in `Head.checkout()` and `Repo.clone_from()`, and preserve the reportability of protection bypasses. Assisted-by: GPT 6.1 Sol Co-authored-by: GPT 6.1 Sol <codex@openai.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are reported for this documentation-only clarification of GitPython’s command-wrapper security responsibilities.
No open issues 🎉
What changed in this PR
This documentation-only PR clarifies the security responsibilities of callers using GitPython’s command wrapper versus higher-level APIs.
Changes:
- Explains that
git.cmd.Gitandrepo.gitexecute caller-supplied commands and options, including their intended effects. - Defines application responsibilities when exposing the wrapper to untrusted callers.
- Distinguishes higher-level protections from direct wrapper behavior and confirms that protection bypasses remain reportable.
| File | Description |
|---|---|
| SECURITY.md | Clarifies command-wrapper trust boundaries, caller responsibilities, and higher-level protections. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.