GHSA-9jjr-qqfp-ppwx

From 9f4043d9dddc1174920e687773f27b7933f48ab6 Mon Sep 17 00:00:00 2001 From: Riccardo Castellotti <rcastell@cern.ch> Date: Thu, 19 Aug 2021 15:49:43 +0200 Subject: [PATCH] Explicitly separate git-ls-remote options from positional arguments --- binderhub/repoproviders.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/binderhub/repoproviders.py b/binderhub/repoproviders.py index f33347b..5d4b87c 100755 --- a/binderhub/repoproviders.py +++ b/binderhub/repoproviders.py @@ -484,7 +484,7 @@ class GitRepoProvider(RepoProvider): self.sha1_validate(self.unresolved_ref) except ValueError: # The ref is a head/tag and we resolve it using `git ls-remote` - command = ["git", "ls-remote", self.repo, self.unresolved_ref] + command = ["git", "ls-remote", "--", self.repo, self.unresolved_ref] result = subprocess.run(command, universal_newlines=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE) if result.returncode: raise RuntimeError("Unable to run git ls-remote to get the `resolved_ref`: {}".format(result.stderr)) -- 2.25.1

from binderhub.repoproviders import (GitHubRepoProvider, GitLabRepoProvider, GistRepoProvider, ZenodoProvider, FigshareProvider, HydroshareProvider, DataverseProvider) c.BinderHub.repo_providers = { 'gh': GitHubRepoProvider, 'gist': GistRepoProvider, 'gl': GitLabRepoProvider, 'zenodo': ZenodoProvider, 'figshare': FigshareProvider, 'hydroshare': HydroshareProvider, 'dataverse': DataverseProvider, }