{"record":{"id":"b34f630750c778ef","repo":"abhigyanpatwari/GitNexus","slug":"clone-contains-an-unsafe-reference-name","errorCode":null,"errorMessage":"clone contains an unsafe reference name","messagePattern":"clone contains an unsafe reference name","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/oracle_assets.py","lineNumber":365,"sourceCode":"        timeout=60,\n        env=deterministic_git_env,\n    )\n    _git_checked(\n        root,\n        [\"update-ref\", \"--no-deref\", \"HEAD\", sanitized_head, original_head],\n        timeout=60,\n    )\n\n    refs_output = _git_checked(\n        root,\n        [\"for-each-ref\", f\"--count={MAX_CLONE_REFS + 1}\", \"--format=%(refname)\"],\n        timeout=60,\n    )\n    refs = refs_output.splitlines() if refs_output else []\n    if len(refs) > MAX_CLONE_REFS:\n        raise ValueError(f\"clone has more than {MAX_CLONE_REFS} references; refusing incomplete sanitization\")\n    if any(not ref.startswith(\"refs/\") or any(character.isspace() for character in ref) for ref in refs):\n        raise ValueError(\"clone contains an unsafe reference name\")\n    for ref in refs:\n        _git_checked(root, [\"update-ref\", \"--no-deref\", \"-d\", ref], timeout=60)\n\n    remote_output = _git_checked(root, [\"remote\"], timeout=60)\n    remotes = remote_output.splitlines() if remote_output else []\n    if len(remotes) > MAX_CLONE_REFS or any(\n        re.fullmatch(r\"[A-Za-z0-9][A-Za-z0-9._/-]{0,255}\", remote) is None or \"..\" in remote for remote in remotes\n    ):\n        raise ValueError(\"clone contains unsafe or unbounded remote metadata\")\n    for remote in remotes:\n        _git_checked(root, [\"remote\", \"remove\", remote], timeout=60)\n\n    _git_checked(\n        root,\n        [\"reflog\", \"expire\", \"--expire=now\", \"--expire-unreachable=now\", \"--all\"],\n        timeout=60,\n    )\n    git_dir = root / \".git\"","sourceCodeStart":347,"sourceCodeEnd":383,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/oracle_assets.py#L347-L383","documentation":"Each ref returned by for-each-ref must start with 'refs/' and contain no whitespace. The guard prevents argument injection into the subsequent `git update-ref --no-deref -d <ref>` and protects the bounded parser. A ref failing this check is treated as unsafe rather than being passed to update-ref.","triggerScenarios":"Triggered when any ref name does not begin with refs/ or contains whitespace. Git itself normally forbids these, so this fires on corrupted or hand-crafted repos where refs have been written through low-level commands.","commonSituations":"A repo whose .git/refs has been edited by hand; a malicious or corrupted clone; refs created via `git update-ref` with unusual names bypassing the porcelain checks.","solutions":["List refs: `git -C <clone> for-each-ref --format='%(refname)'` and find the offender.","Delete the offending ref carefully with a literal SHA arg or by removing the loose ref file under .git/refs.","Re-clone from a trusted remote to discard the corrupted ref store."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import re\nfrom pathlib import Path\nfrom eval.workflow_bench.process_control import run_checked\n\ndef ref_names_are_safe(clone: Path) -> bool:\n    out = run_checked([\"git\", \"-C\", str(clone), \"for-each-ref\", \"--format=%(refname)\"], timeout=60).stdout_tail.strip()\n    for ref in out.splitlines():\n        if not ref.startswith(\"refs/\") or re.search(r\"\\s\", ref):\n            return False\n    return True\n","typeGuard":"def is_unsafe_ref_name(exc: BaseException) -> bool:\n    return isinstance(exc, ValueError) and \"unsafe reference name\" in str(exc)\n","tryCatchPattern":"try:\n    oracle_assets.sanitize_clone_for_hidden_oracles(clone)\nexcept ValueError as exc:\n    quarantine(clone)\n    raise AbortTask(str(exc)) from exc\n","preventionTips":["Only sanitize clones from trusted remotes.","Treat any ref not under refs/ as corruption and re-clone."],"tags":["git","refs","argument-injection","security","oracle","sanitization","invariant"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}