{"id":"9b96d423e955e440","repo":"python-poetry/poetry","slug":"invalid-git-parameter-parameter","errorCode":null,"errorMessage":"Invalid Git parameter: {parameter}","messagePattern":"Invalid Git parameter: (.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"src/poetry/vcs/git/system.py","lineNumber":59,"sourceCode":"        env = os.environ.copy()\n        env[\"GIT_TERMINAL_PROMPT\"] = \"0\"\n\n        subprocess.run(\n            git_command + list(args),\n            capture_output=True,\n            env=env,\n            text=True,\n            encoding=\"utf-8\",\n            check=True,\n        )\n\n    @staticmethod\n    def _check_parameter(parameter: str) -> None:\n        \"\"\"\n        Checks a git parameter to avoid unwanted code execution.\n        \"\"\"\n        if parameter.strip().startswith(\"-\"):\n            raise RuntimeError(f\"Invalid Git parameter: {parameter}\")\n","sourceCodeStart":41,"sourceCodeEnd":60,"githubUrl":"https://github.com/python-poetry/poetry/blob/92b74dcfe348d0e01e14d40d6c1fa47a4ee04a54/src/poetry/vcs/git/system.py#L41-L60","documentation":"SystemGit._check_parameter rejects any parameter (a repository URL or a revision) whose stripped form begins with '-', raising RuntimeError. This is a security guard against git argument/option injection: without it, a crafted value could be interpreted as a git flag (e.g. '--upload-pack=...') enabling code execution. Both SystemGit.clone and SystemGit.checkout run every user-supplied value through this check.","triggerScenarios":"Passing a git dependency URL or a rev that starts with '-' after stripping whitespace, e.g. a repository value of '--upload-pack=evil' or a rev like '-c core.xxx'.","commonSituations":"A security-hardening rejection of injection attempts; a malformed ref/URL produced by a templating bug that prepends a stray dash; a config that accidentally starts the value with a flag character.","solutions":["Sanitize the URL/revision so its stripped form does not begin with '-'.","Use a legitimate git URL (https://..., git@..., ssh://...) and a real ref/sha.","If the value genuinely must contain a leading dash, rework the configuration so it is passed as a value, not a flag (git supports '--' separator, but Poetry refuses it for safety)."],"exampleFix":"# before - value starts with a dash\nlib = { git = \"--upload-pack=/tmp/evil\" }\n# after - use a real repository url\nlib = { git = \"https://github.com/acme/lib.git\", rev = \"abcdef0\" }","handlingStrategy":"validation","validationCode":"def is_safe_git_parameter(parameter: str) -> bool:\n    return not parameter.strip().startswith('-')","typeGuard":"def is_safe_git_parameter(parameter: str) -> bool:\n    return isinstance(parameter, str) and not parameter.strip().startswith('-')","tryCatchPattern":"from poetry.vcs.git.system import SystemGit\ntry:\n    SystemGit.clone(repository, dest)\nexcept RuntimeError as e:\n    if 'Invalid Git parameter' in str(e):\n        # sanitize the url/rev so it does not start with '-'\n        raise","preventionTips":["Sanitize user-supplied URLs/revisions: reject any whose stripped form starts with '-'.","Use well-formed git URLs and real refs only.","Treat leading-dash values as untrusted input to prevent git option injection."],"tags":["git","vcs","security","injection","validation"],"analyzedSha":"92b74dcfe348d0e01e14d40d6c1fa47a4ee04a54","analyzedAt":"2026-08-04T20:33:34.072Z","schemaVersion":2}