Re: [RFC PATCH 6/6] hex: allow only lowercase object IDs in breaking changes mode

From: brian m. carlson <sandals@crustytoothpaste.net>
Date: Aug 2, 2026, 22:09 UTC
Message-ID: <am_AL9dymrkidizF@fruit.crustytoothpaste.net>
In-Reply-To: <xmqqv79vha69.fsf@gitster.g>

On 2026-07-31 at 07:48:14, Junio C Hamano wrote:

Show 8 quoted lines

> "brian m. carlson" <sandals@crustytoothpaste.net> writes:
> 
> > Git has historically allowed either lowercase or uppercase hex for
> > object IDs, but it has always emitted only lowercase.  This has caused
> > people to expect only lowercase and not handle uppercase.
> 
> It is violation of Postel's Law by other people.  We do not
> necessarily have to follow suit.

Postel's Law was a great idea on the early Internet, but it is unfortunately no longer a good idea. The problem is that being liberal in what you accept these days usually has security implications.

TLS cannot be liberal in what it accepts because that means potentially allowing attacker-controlled data. Even HTTP cannot do that because we've seen where refusing to reject requests with both Content-Length and Transfer-Encoding: chunked means that two parts of a backend can disagree on the content, allowing request smuggling.

We've seen these problems in our code where not caring about CR comes back to bite us on Windows in a security-sensitive way.

Modern development effectively requires being clear and definitive about what data is accepted and what is not, as well as what meaning is given to the data that is accepted.

Show 7 quoted lines

> Even though I said throwing object names in a single category makes
> sense, it may make sense to treat the object names that we locally
> use to access our own object database and those that we use when
> talking with _other_ people on the net separately for the Robustness
> principle, we keep being strict in what we produce and stick to
> lowercase, while accepting uppercase produced by those third-party
> reimplementations of Git.

Unfortunately, that also doesn't fix most of the security problems I've seen, which involve object IDs that get passed on the command line when tools invoke Git. It does fix the problem with round-tripping objects between hash algorithms, though, but I don't really want to audit every use of oid_to_hex in our codebase to half-fix this situation.

-- 
brian m. carlson (they/them)
Toronto, Ontario, CA