Article
A developer explains why many tools need Git’s new marker --end-of-options and how it differs from the long-standing -- separator. In Git, -- is already used to split revisions from paths, so scripts passing untrusted revision strings could still be interpreted as options when a ref starts with a dash. The correct pattern is therefore git log --end-of-options "$rev" -- "$path", with one marker for option parsing and one for pathspec parsing. The post connects this parser design issue to real CWE-88 argument-injection cases, including Docker and four 2017 VCS vulnerabilities where crafted hosts or refs became options for ssh-like clients. A broad survey of package managers shows seventeen of nineteen still invoke git directly and historically patched around this risk with leading-dash checks or --, with only one using --end-of-options before CVE-2025-68119. The fix rollout is uneven because support for --end-of-options arrives by command (rev-parse in 2.30.0, checkout/reset in 2.43.1), forcing some projects to choose compatibility constraints over complete coverage. The post also contrasts CLI-based wrappers against libgit-style libraries: embedded implementations avoid argv-injection but shift maintenance to consistent safety updates. Homebrew’s proposed update reflects this tradeoff by raising its minimum Git version and adding --end-of-options in targeted commands while skipping older-command coverage due to version ceilings.
The comments question the original design choice, noting that reusing
--differently from POSIX creates human-facing confusion and brittle command forms. Others joke about naming branches--to test parsing rules, while still recognizing the practical downside. Readers also wish for object-oriented shells, arguing that richer typed commands, such as object-aware pipelines, would better express boundary distinctions than today’s option-heavy syntax.