{"record":{"id":"edb091ef4408e325","repo":"yamadashy/repomix","slug":"invalid-branch-or-ref-name-name-must-not-start-wi","errorCode":null,"errorMessage":"Invalid branch or ref name. Name must not start with '-': ${ref}","messagePattern":"Invalid branch or ref name\\. Name must not start with '-': (.+?)","errorType":"validation","errorClass":"RepomixError","httpStatus":null,"severity":"critical","filePath":"src/core/git/gitCommand.ts","lineNumber":260,"sourceCode":"    if (url.startsWith('https://')) {\n      new URL(url);\n    }\n  } catch (error: unknown) {\n    logger.trace('Invalid repository URL:', redactErrorMessage(error));\n    throw new RepomixError(`Invalid repository URL. Please provide a valid URL: ${redactUrl(url)}`);\n  }\n};\n\n/**\n * Validates a Git ref (branch, tag, or commit) before passing it to git commands.\n * A ref starting with '-' could be interpreted as a git option (e.g. --upload-pack),\n * enabling argument injection. Git's own refname rules also forbid leading '-',\n * so rejecting it is safe for all legitimate branches, tags, and SHAs.\n * @throws {RepomixError} If the ref could be interpreted as a command-line option\n */\nexport const validateGitRef = (ref: string): void => {\n  if (ref.startsWith('-')) {\n    throw new RepomixError(`Invalid branch or ref name. Name must not start with '-': ${ref}`);\n  }\n};\n","sourceCodeStart":242,"sourceCodeEnd":263,"githubUrl":"https://github.com/yamadashy/repomix/blob/f465ad909315a22120636baf03fa5e28701a50cb/src/core/git/gitCommand.ts#L242-L263","documentation":"validateGitRef rejects any branch, tag, or ref string that starts with '-' because such a value would be parsed by git as a command-line option instead of a ref name (argument injection). Git's own refname rules forbid leading '-', so legitimate refs are never affected. The check is a security guard applied before the ref is passed to execGitShallowClone.","triggerScenarios":"Calling the clone/remote-processing API with a branch or ref argument whose value begins with a hyphen, e.g. '--upload-pack=malicious', '-oProxyCommand=...', or a config value accidentally read with a leading dash.","commonSituations":"A CLI flag or config-file value like `--branch -foo`; untrusted user input passed as the ref; shell word-splitting or log-parsing that leaves a '-' prefix on the ref name.","solutions":["Remove the leading '-' from the ref/branch value before calling the API.","Verify the ref exists: run `git rev-parse --verify <ref>` locally and use the exact valid name.","If the value comes from config or CLI args, fix the source (quoting, splitting, flag parsing) that injected the dash."],"exampleFix":"// before\nawait repomixRemote({ repo: 'user/repo', branch: '--upload-pack=evil' });\n// after\nawait repomixRemote({ repo: 'user/repo', branch: 'main' });","handlingStrategy":"validation","validationCode":"if (typeof ref === 'string' && ref.startsWith('-')) {\n  throw new Error(`Refusal: ref must not start with '-': ${ref}`);\n}\nawait pack({ branch: ref });","typeGuard":"const isValidRef = (ref: unknown): ref is string =>\n  typeof ref === 'string' && ref.length > 0 && !ref.startsWith('-');","tryCatchPattern":null,"preventionTips":["Never pass raw user input as a branch/ref without validating it starts with an alphanumeric character.","Sanitize CLI args and config values (trim whitespace, strip leading dashes) before use.","Treat ref names as data, never as shell/command fragments; prefer typed config objects over string interpolation."],"tags":["security","argument-injection","git","validation"],"backgroundTag":"argument-injection","analyzedSha":"f465ad909315a22120636baf03fa5e28701a50cb","analyzedAt":"2026-08-29T01:27:42.024Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}