src-d / go-git

Project has been moved to: https://github.com/go-git/go-git
https://github.com/go-git/go-git
Apache License 2.0
4.91k stars 542 forks source link

Ref names aren't validated leading to interesting behavior #1172

Open thecjharries opened 5 years ago

thecjharries commented 5 years ago

While I was learning this library this weekend, I noticed there's no validation on ref names. I cooked up a quick demo to show how to take advantage of that behavior. It's not a huge deal given that most people probably aren't trying to screw with their branch names.

https://github.com/thecjharries/go-git-ref-bug

I also looked at fixing the problem. Unfortunately, the root cause, a simple string for ReferenceName, is too embedded everywhere to change with my very limited knowledge of Go. I'm about to submit a PR with a rough draft of a solution that I'll probably be using myself elsewhere.