phacility/phabricator · error · Exception

Refusing to list potentially dangerous ref ("%s") beginning

Error message

Refusing to list potentially dangerous ref ("%s") beginning with "-".

What it means

Thrown while building a 'git ls-remote' command: each configured ref rule (pattern restricting which refs are listed) is checked, and any rule beginning with a dash is rejected. Older git (before roughly January 2016, see T12416) does not support the '--' argument terminator for ls-remote, so a ref rule starting with '-' could be parsed as a flag and change command behavior. The check is a defensive injection guard, not a normal configuration state.

Source

Thrown at src/applications/repository/engine/PhabricatorRepositoryPullEngine.php:563

    // See T13448. When listing local remotes, we want to list everything,
    // not just refs we expect to fetch. This allows us to detect that we have
    // undesirable refs (which have been deleted in the remote, but are still
    // present locally) so we can update our state to reflect the correct
    // remote state.

    if ($is_local) {
      $ref_rules = array();
    } else {
      $ref_rules = $this->getGitRefRules($repository);

      // NOTE: "git ls-remote" does not support "--" until circa January 2016.
      // See T12416. None of the flags to "ls-remote" appear dangerous, but
      // refuse to list any refs beginning with "-" just in case.

      foreach ($ref_rules as $ref_rule) {
        if (preg_match('/^-/', $ref_rule)) {
          throw new Exception(
            pht(
              'Refusing to list potentially dangerous ref ("%s") beginning '.
              'with "-".',
              $ref_rule));
        }
      }
    }

    list($stdout) = $repository->execxRemoteCommand(
      'ls-remote %P %Ls',
      $remote_envelope,
      $ref_rules);

    // Empty repositories don't have any refs.
    if ($stdout === null || !strlen(rtrim($stdout))) {
      return array();
    }

View on GitHub (pinned to 5720a38cfe)

Solutions

Edit the repository ref rule configuration and remove the leading dash (rules should look like 'refs/heads/*' or 'refs/tags/*')
Validate rule patterns in whatever automation writes them: they must not start with '-'
Re-run pull or update after fixing the rule

Example fix

# before (repository ref rule)
-refs/heads/master

# after
refs/heads/master

Defensive patterns

Strategy: validation

Validate before calling

// Validate ref rules before saving them into repository configuration:
foreach ($ref_rules as $rule) {
  if (preg_match('/^-/', $rule)) {
    throw new InvalidArgumentException(
      "Ref rule '{$rule}' must not begin with '-'");
  }
}

Prevention

Standardize ref rule patterns on refs/... prefixes
Validate repository configuration in the editing or automation layer, not at pull time
Review pasted rules for leading dashes or whitespace before saving

When it happens

Trigger: A repository ref rule configuration value whose first character is a dash, such as '-refs/heads/master' instead of 'refs/heads/master'; automation writing rule lists without validating the pattern shape; copy-paste errors in the ref rules field.

Common situations: Rules pasted from documentation with a leading list dash or bullet; typos when configuring which refs Phabricator tracks; scripted repository setups writing unvalidated patterns.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/16088055f15972d6. Report an issue: GitHub.