Re: [PATCH v13 7/8] history: create squashed commits without editing

From: Junio C Hamano <gitster@pobox.com>
Date: Aug 17, 2026, 15:24 UTC
Message-ID: <xmqqbjb07osr.fsf@gitster.g>
In-Reply-To: <f34669ad-9157-4f13-a3c1-c0abbc660497@gmail.com>

Phillip Wood <phillip.wood123@gmail.com> writes:

Show 6 quoted lines

> It's piped into "tr" to check that
>
> 	target = lookup_commit_reference_by_name(s);
> 	if (target && istarts_with(oid_to_hex(&target->object.oid), s))
>
> uses istarts_with() so that we accept uppercase object ids.

You should check in with brian about istarts_with() that is used here, as I suspect he missed it in his effort to declare uppercase hexadecimal literals invalid. In the meantime, '| tr' must be removed if this topic wants to play nicely with the 'bc/restrict-hex-to-lowercase' topic. In my fixup patch, I changed it to use 'rev-parse --short' to test at least the "starts with" aspect of this code.

Show 5 quoted lines

> I've just had a quick look at that other thread, it would be more 
> convincing to me if there was some explanation of the security issues 
> that accepting uppercase object ids causes. While I appreciate brian may 
> not be able to talk about specific vulnerabilities in particular 
> products, it would help to outline the security issues in general terms.

True.

Thanks.