Skip to content

fix: reject --pathspec-from-file to prevent log disclosure - #777

Merged
EndBug merged 1 commit into
mainfrom
cursor/6b69f9ba
Aug 16, 2026
Merged

fix: reject --pathspec-from-file to prevent log disclosure#777
EndBug merged 1 commit into
mainfrom
cursor/6b69f9ba

Conversation

@EndBug

@EndBug EndBug commented Aug 16, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Owner

Summary

  • Reject --pathspec-from-file and --pathspec-file-nul (including unique Git abbreviations) in matchGitArgs before any Git command runs.
  • These options can read an arbitrary runner file; Git then interpolates unmatched pathspecs into fatal: pathspec '…' errors that the action logs.
  • Cover add/remove/commit, dry-run, default ignore handling, YAML arrays, and abbreviations in unit and integration tests.

Test plan

  • npm test (pre-commit already passed: 87 tests + lint + lib/ rebuild)
  • Confirm add: --pathspec-from-file=<outside-file> --pathspec-file-nul fails with not allowed and does not print the file contents
  • Confirm a normal add: '.' commit still works

Made with Cursor

Summary by CodeRabbit

  • Security

    • Blocked Git pathspec-from-file options and abbreviations in add, commit, and remove operations to prevent unintended filesystem data exposure.
    • Rejected these options even when unsafe Git protocols are enabled.

  • Documentation

    • Clarified restrictions on pathspec-from-file options, unmatched quotes, and commit option combinations.

  • Bug Fixes

    • Added validation to reject unsafe options early, including during dry runs, without modifying commits or revealing file contents.

@EndBug @cursoragent
fix: reject --pathspec-from-file to prevent log disclosure
cebc153 
Git interpolates unmatched pathspecs into fatal errors, so these options can copy an arbitrary runner file into the action log.

Co-authored-by: Cursor <cursoragent@cursor.com>
@coderabbitai

coderabbitai Bot commented Aug 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. πŸŽ‰

ℹ️ Recent review info
βš™οΈ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8efbf35d-0101-4463-8cd8-11e9f0b19094

πŸ“₯ Commits

Reviewing files that changed from the base of the PR and between d809cc8 and cebc153.

πŸ“’ Files selected for processing (6)
  • README.md
  • action.yml
  • lib/index.js
  • src/util.ts
  • test/integration/action.test.ts
  • test/util.test.ts

Included review availability: Your plan includes up to 4 reviews per rolling hour; 2 remain after this review.

πŸ“ Walkthrough

Walkthrough

The action now rejects Git pathspec file-reading options and their abbreviations during argument validation. Documentation describes the restriction. Unit and integration tests cover rejection, dry-run behavior, unchanged HEAD state, and non-disclosure of pathspec file contents.

Changes

Pathspec file-option restriction

Layer / File(s) Summary
Argument denylist and validation
src/util.ts, action.yml, README.md		 matchGitArgs rejects pathspec file options and documents the filesystem disclosure risk. Action inputs and README describe the restriction.
Argument matcher coverage
test/util.test.ts		 Tests cover canonical options, abbreviations, option values, message values, and unsafe protocol mode.
Action integration coverage
test/integration/action.test.ts		 Tests cover add, remove, and commit, including YAML arrays and dry-run parsing without HEAD changes or pathspec content disclosure.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: βšͺ Minimal Β· up to cebc1

The PR rejects file-based pathspec options before Git runs to prevent argument contents from being logged; no actionable merge-blocking risk remains beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant ActionInputs
  participant matchGitArgs
  participant GitCommand
  ActionInputs->>matchGitArgs: validate Git arguments
  matchGitArgs-->>ActionInputs: reject pathspec file option
  ActionInputs-->>GitCommand: do not execute Git command
Loading
πŸš₯ Pre-merge checks | βœ… 5
βœ… Passed checks (5 passed)
Check name Status Explanation
Description Check βœ… Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check βœ… Passed The title clearly summarizes the main change and states its security purpose.
Docstring Coverage βœ… Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check βœ… Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check βœ… Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
πŸ“ Generate docstrings
  • Create stacked PR
  • Commit on current branch
πŸ§ͺ Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/6b69f9ba

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❀️ Share

Comment @coderabbitai help to get the list of available commands.

@EndBug
EndBug marked this pull request as ready for review August 16, 2026 23:29
@EndBug
EndBug merged commit c8ad2e2 into main Aug 16, 2026
11 checks passed
@EndBug
EndBug deleted the cursor/6b69f9ba branch August 16, 2026 23:32
@coderabbitai coderabbitai Bot mentioned this pull request Aug 18, 2026
Merged
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@EndBug