[PATCH v2 10/17] refs: improve verification for-each-ref options

From: Patrick Steinhardt <ps@pks.im>
Date: Feb 23, 2026, 11:59 UTC
Message-ID: <20260223-pks-refs-for-each-unification-v2-10-515d48c8087b@pks.im>
In-Reply-To: <20260223-pks-refs-for-each-unification-v2-0-515d48c8087b@pks.im>

Improve verification of the passed-in for-each-ref options:

  - Require that the `refs` store must be given. It's arguably very
    surprising that we simply return successfully in case the ref store
    is a `NULL` pointer.

  - When expected to trim ref prefixes we will `BUG()` in case the
    refname would become empty or in case we're expected to trim a
    longer prefix than the refname is long. As such, this case is only
    guaranteed to _not_ `BUG()` in case the caller also specified a
    prefix. And furthermore, that prefix must end in a trailing slash,
    as otherwise it may produce an exact match that could lead us to
    trim to the empty string.

An audit shows that there are no callsites that rely on either of these behaviours, so this should not result in a functional change.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
---
 refs.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/refs.c b/refs.c
index 0aa3b68dd9..a57eafd6de 100644
--- a/refs.c
+++ b/refs.c
@@ -1859,7 +1859,18 @@ int refs_for_each_ref_ext(struct ref_store *refs,
 	int ret;
 
 	if (!refs)
-		return 0;
+		BUG("no ref store passed");
+
+	if (opts->trim_prefix) {
+		size_t prefix_len;
+
+		if (!opts->prefix)
+			BUG("trimming only allowed with a prefix");
+
+		prefix_len = strlen(opts->prefix);
+		if (prefix_len == opts->trim_prefix && opts->prefix[prefix_len - 1] != '/')
+			BUG("ref pattern must end in a trailing slash when trimming");
+	}
 
 	if (opts->pattern) {
 		if (!opts->prefix && !starts_with(opts->pattern, "refs/"))

-- 
2.53.0.536.g309c995771.dirty