Reject abbreviated unsafe git options

Git's parse-options machinery accepts an unambiguous prefix of a long option. In the reference Git checkout, parse-options.c records abbreviated matches in parse_long_opt() and dispatches the abbreviated option when it is not ambiguous.

GitPython normalized unsafe option names before comparing them to the deny-list, but only exact canonical names were rejected. That allowed forms such as --upl=... to bypass the --upload-pack guard while still being interpreted by Git as the unsafe option.

Make the shared unsafe-option check reject non-empty canonical candidates that are prefixes of blocked canonical option names, while preserving exact-match behavior. Add coverage for the shared helper and for clone, fetch, pull, push, and ls-remote abbreviation forms.

Validation:
- .venv/bin/python -m compileall -q git/cmd.py test/test_git.py test/test_clone.py test/test_remote.py
- git diff --check
- Focused pytest/unittest execution could not run because the environment is missing pytest, ddt, and gitdb, and PyPI access failed while installing test-requirements.txt.

Author: codex

test/test_clone.py

@@ -117,11 +117,13 @@ def test_clone_unsafe_options(self, rw_repo):
             tmp_file = tmp_dir / "pwn"
             unsafe_options = [
                 f"--upload-pack='touch {tmp_file}'",
+                f"--upl='touch {tmp_file}'",
                 f"-u 'touch {tmp_file}'",
                 f"-utouch {tmp_file}; false",
                 f"-futouch${{IFS}}{tmp_file}; false",
                 f"-qutouch${{IFS}}{tmp_file}; false",
                 "--config=protocol.ext.allow=always",
+                "--conf=protocol.ext.allow=always",
                 "-c protocol.ext.allow=always",
                 "-cprotocol.ext.allow=always",
                 "-vcprotocol.ext.allow=always",
@@ -134,8 +136,10 @@ def test_clone_unsafe_options(self, rw_repo):
             unsafe_options = [
                 {"upload-pack": f"touch {tmp_file}"},
                 {"upload_pack": f"touch {tmp_file}"},
+                {"upl": f"touch {tmp_file}"},
                 {"u": f"touch {tmp_file}"},
                 {"config": "protocol.ext.allow=always"},
+                {"conf": "protocol.ext.allow=always"},
                 {"c": "protocol.ext.allow=always"},
             ]
             for unsafe_option in unsafe_options:

test/test_git.py

@@ -164,6 +164,9 @@ def test_check_unsafe_options_normalizes_kwargs(self):
             (["c"], ["-c"]),
             (["--upload-pack=/tmp/helper"], ["--upload-pack"]),
             (["--config core.filemode=false"], ["--config"]),
+            (["--upl=/tmp/helper"], ["--upload-pack"]),
+            (["conf"], ["--config"]),
+            (["--out=/tmp/output"], ["--output"]),
         ]
 
         for options, unsafe_options in cases:

test/test_remote.py

@@ -1022,14 +1022,22 @@ def test_ls_remote_unsafe_options(self, rw_repo):
         with tempfile.TemporaryDirectory() as tdir:
             tmp_dir = Path(tdir)
             tmp_file = tmp_dir / "pwn"
-            unsafe_options = [{"upload-pack": f"touch {tmp_file}"}, {"upload_pack": f"touch {tmp_file}"}]
+            unsafe_options = [
+                {"upload-pack": f"touch {tmp_file}"},
+                {"upload_pack": f"touch {tmp_file}"},
+                {"upl": f"touch {tmp_file}"},
+            ]
             for unsafe_option in unsafe_options:
                 with self.assertRaises(UnsafeOptionError):
                     rw_repo.git.ls_remote(".", **unsafe_option)
             with self.assertRaises(UnsafeOptionError):
                 rw_repo.git.ls_remote([f"--upload-pack={tmp_file}"], ".")
+            with self.assertRaises(UnsafeOptionError):
+                rw_repo.git.ls_remote([f"--upl={tmp_file}"], ".")
             with self.assertRaises(UnsafeOptionError):
                 rw_repo.git.ls_remote(f"--upload-pack={tmp_file}", ".")
+            with self.assertRaises(UnsafeOptionError):
+                rw_repo.git.ls_remote(f"--upl={tmp_file}", ".")
             with self.assertRaises(UnsafeOptionError):
                 rw_repo.git.ls_remote("--upload-pack", "touch", ".")