{"record":{"id":"de85502a2161210a","repo":"alibaba/open-code-review","slug":"s-value-q-is-not-a-valid-git-ref-refs-must-not","errorCode":null,"errorMessage":"%s value %q is not a valid git ref: refs must not start with '-'","messagePattern":"(.+?) value %q is not a valid git ref: refs must not start with '-'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/opencodereview/review_cmd.go","lineNumber":475,"sourceCode":"}\n\n// validateReviewRefs rejects ref-option injection (#112): any --from/--to/\n// --commit value must be a real commit ref and must not start with '-'.\nfunc validateReviewRefs(repoDir string, opts reviewOptions) error {\n\trefs := []struct {\n\t\tflag string\n\t\tref  string\n\t}{\n\t\t{\"--from\", opts.from},\n\t\t{\"--to\", opts.to},\n\t\t{\"--commit\", opts.commit},\n\t}\n\tfor _, item := range refs {\n\t\tif item.ref == \"\" {\n\t\t\tcontinue\n\t\t}\n\t\tif strings.HasPrefix(item.ref, \"-\") {\n\t\t\treturn fmt.Errorf(\"%s value %q is not a valid git ref: refs must not start with '-'\", item.flag, item.ref)\n\t\t}\n\t\tif out, err := runGitCmd(repoDir, \"rev-parse\", \"--verify\", \"--end-of-options\", item.ref+\"^{commit}\"); err != nil {\n\t\t\tmsg := strings.TrimSpace(string(out))\n\t\t\tif msg != \"\" {\n\t\t\t\treturn fmt.Errorf(\"%s value %q is not a valid commit ref: %s\", item.flag, item.ref, msg)\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"%s value %q is not a valid commit ref\", item.flag, item.ref)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc runPreviewContext(ctx context.Context, cc *commonContext, opts reviewOptions, out io.Writer) error {\n\tpreview, err := agent.Preview(ctx, agent.Args{\n\t\tRepoDir:    cc.RepoDir,\n\t\tFrom:       opts.from,\n\t\tTo:         opts.to,\n\t\tCommit:     opts.commit,","sourceCodeStart":457,"sourceCodeEnd":493,"githubUrl":"https://github.com/alibaba/open-code-review/blob/5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f/cmd/opencodereview/review_cmd.go#L457-L493","documentation":"validateReviewRefs guards against ref-option injection (issue #112): any value passed to --from/--to/--commit must be a real git ref and must not begin with '-'. A leading '-' would be interpreted by git as an option flag rather than a ref name, so the tool rejects it outright before invoking git.","triggerScenarios":"Calling `ocr review --from/-to/--commit` with a value starting with '-' (e.g. --commit \"--upload-pack=...\" or a negative-looking string), from executeReviewContext, loadDelegateContext, or the tests.","commonSituations":"Shell scripting that interpolates untrusted/empty values into the flag; malicious input passed to a wrapper around ocr; typo like `--commit -1`.","solutions":["Pass a valid ref: use a branch name, tag, or commit SHA that does not start with '-'.","Quote arguments in scripts so an empty value doesn't shift into the flag position.","Validate/strip user-supplied refs in any wrapper before forwarding them to ocr.","Use `git rev-parse --verify <ref>^{commit}` locally to sanity-check the value first."],"exampleFix":"// before\nocr review --commit --upload-pack=evil\n// after\nocr review --commit abc1234","handlingStrategy":"validation","validationCode":"func safeRef(v string) error {\n    if strings.HasPrefix(v, \"-\") {\n        return fmt.Errorf(\"ref %q must not start with '-'\", v)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := validateReviewRefs(repoDir, opts); err != nil {\n    // treat as user input error: print usage, do not retry\n    return err\n}","preventionTips":["Quote all flag values in shell scripts so empty vars don't shift positions.","Never interpolate untrusted strings into --from/--to/--commit.","Sanitize refs in wrappers before invoking ocr."],"tags":["security","git","injection"],"backgroundTag":"git-ref-option-injection","analyzedSha":"5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f","analyzedAt":"2026-09-02T02:08:09.116Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}