alibaba/open-code-review · error

%s value %q is not a valid git ref: refs must not start with

Error message

%s value %q is not a valid git ref: refs must not start with '-'

What it means

validateReviewRefs guards against ref-option injection (issue #112): any value passed to --from/--to/--commit must be a real git ref and must not begin with '-'. A leading '-' would be interpreted by git as an option flag rather than a ref name, so the tool rejects it outright before invoking git.

Source

Thrown at cmd/opencodereview/review_cmd.go:475

}

// validateReviewRefs rejects ref-option injection (#112): any --from/--to/
// --commit value must be a real commit ref and must not start with '-'.
func validateReviewRefs(repoDir string, opts reviewOptions) error {
	refs := []struct {
		flag string
		ref  string
	}{
		{"--from", opts.from},
		{"--to", opts.to},
		{"--commit", opts.commit},
	}
	for _, item := range refs {
		if item.ref == "" {
			continue
		}
		if strings.HasPrefix(item.ref, "-") {
			return fmt.Errorf("%s value %q is not a valid git ref: refs must not start with '-'", item.flag, item.ref)
		}
		if out, err := runGitCmd(repoDir, "rev-parse", "--verify", "--end-of-options", item.ref+"^{commit}"); err != nil {
			msg := strings.TrimSpace(string(out))
			if msg != "" {
				return fmt.Errorf("%s value %q is not a valid commit ref: %s", item.flag, item.ref, msg)
			}
			return fmt.Errorf("%s value %q is not a valid commit ref", item.flag, item.ref)
		}
	}
	return nil
}

func runPreviewContext(ctx context.Context, cc *commonContext, opts reviewOptions, out io.Writer) error {
	preview, err := agent.Preview(ctx, agent.Args{
		RepoDir:    cc.RepoDir,
		From:       opts.from,
		To:         opts.to,
		Commit:     opts.commit,

View on GitHub (pinned to 5cf97d0d15)

Solutions

1. Pass a valid ref: use a branch name, tag, or commit SHA that does not start with '-'.
2. Quote arguments in scripts so an empty value doesn't shift into the flag position.
3. Validate/strip user-supplied refs in any wrapper before forwarding them to ocr.
4. Use `git rev-parse --verify <ref>^{commit}` locally to sanity-check the value first.

Example fix

// before
ocr review --commit --upload-pack=evil
// after
ocr review --commit abc1234

func safeRef(v string) error {
    if strings.HasPrefix(v, "-") {
        return fmt.Errorf("ref %q must not start with '-'", v)
    }
    return nil
}

if err := validateReviewRefs(repoDir, opts); err != nil {
    // treat as user input error: print usage, do not retry
    return err
}

When it happens

Trigger: Calling `ocr review --from/-to/--commit` with a value starting with '-' (e.g. --commit "--upload-pack=..." or a negative-looking string), from executeReviewContext, loadDelegateContext, or the tests.

Common situations: Shell scripting that interpolates untrusted/empty values into the flag; malicious input passed to a wrapper around ocr; typo like `--commit -1`.

Related errors

• preview failed: %w
• git log failed: %w
• resolve current input identity: %w
• %s is not a git repository, code review requires a valid git
• %s value %q is not a valid commit ref: %s

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/de85502a2161210a. Report an issue: GitHub.