{"record":{"id":"16088055f15972d6","repo":"phacility/phabricator","slug":"refusing-to-list-potentially-dangerous-ref-s","errorCode":null,"errorMessage":"Refusing to list potentially dangerous ref (\"%s\") beginning with \"-\".","messagePattern":"Refusing to list potentially dangerous ref \\(\"(.+?)\"\\) beginning with \"-\"\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/repository/engine/PhabricatorRepositoryPullEngine.php","lineNumber":563,"sourceCode":"\n    // See T13448. When listing local remotes, we want to list everything,\n    // not just refs we expect to fetch. This allows us to detect that we have\n    // undesirable refs (which have been deleted in the remote, but are still\n    // present locally) so we can update our state to reflect the correct\n    // remote state.\n\n    if ($is_local) {\n      $ref_rules = array();\n    } else {\n      $ref_rules = $this->getGitRefRules($repository);\n\n      // NOTE: \"git ls-remote\" does not support \"--\" until circa January 2016.\n      // See T12416. None of the flags to \"ls-remote\" appear dangerous, but\n      // refuse to list any refs beginning with \"-\" just in case.\n\n      foreach ($ref_rules as $ref_rule) {\n        if (preg_match('/^-/', $ref_rule)) {\n          throw new Exception(\n            pht(\n              'Refusing to list potentially dangerous ref (\"%s\") beginning '.\n              'with \"-\".',\n              $ref_rule));\n        }\n      }\n    }\n\n    list($stdout) = $repository->execxRemoteCommand(\n      'ls-remote %P %Ls',\n      $remote_envelope,\n      $ref_rules);\n\n    // Empty repositories don't have any refs.\n    if ($stdout === null || !strlen(rtrim($stdout))) {\n      return array();\n    }\n","sourceCodeStart":545,"sourceCodeEnd":581,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/repository/engine/PhabricatorRepositoryPullEngine.php#L545-L581","documentation":"Thrown while building a 'git ls-remote' command: each configured ref rule (pattern restricting which refs are listed) is checked, and any rule beginning with a dash is rejected. Older git (before roughly January 2016, see T12416) does not support the '--' argument terminator for ls-remote, so a ref rule starting with '-' could be parsed as a flag and change command behavior. The check is a defensive injection guard, not a normal configuration state.","triggerScenarios":"A repository ref rule configuration value whose first character is a dash, such as '-refs/heads/master' instead of 'refs/heads/master'; automation writing rule lists without validating the pattern shape; copy-paste errors in the ref rules field.","commonSituations":"Rules pasted from documentation with a leading list dash or bullet; typos when configuring which refs Phabricator tracks; scripted repository setups writing unvalidated patterns.","solutions":["Edit the repository ref rule configuration and remove the leading dash (rules should look like 'refs/heads/*' or 'refs/tags/*')","Validate rule patterns in whatever automation writes them: they must not start with '-'","Re-run pull or update after fixing the rule"],"exampleFix":"# before (repository ref rule)\n-refs/heads/master\n\n# after\nrefs/heads/master","handlingStrategy":"validation","validationCode":"// Validate ref rules before saving them into repository configuration:\nforeach ($ref_rules as $rule) {\n  if (preg_match('/^-/', $rule)) {\n    throw new InvalidArgumentException(\n      \"Ref rule '{$rule}' must not begin with '-'\");\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize ref rule patterns on refs/... prefixes","Validate repository configuration in the editing or automation layer, not at pull time","Review pasted rules for leading dashes or whitespace before saving"],"tags":["phabricator","git","ls-remote","argument-injection","configuration"],"backgroundTag":"unsafe-cli-argument-rejected","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}