Verify that the commit(s) passed to git diff do not resemble a command-line option

jcouball · jcouball · commit 00c4939d0f62 · 2024-08-24T15:02:23.000-07:00
diff --git a/lib/git/lib.rb b/lib/git/lib.rb
@@ -526,7 +526,24 @@ def grep(string, opts = {})
       hsh
     end
 
+    # Validate that the given arguments cannot be mistaken for a command-line option
+    #
+    # @param arg_name [String] the name of the arguments to mention in the error message
+    # @param args [Array<String, nil>] the arguments to validate
+    #
+    # @raise [ArgumentError] if any of the parameters are a string starting with a hyphen
+    # @return [void]
+    #
+    def validate_no_options(arg_name, *args)
+      invalid_args = args.select { |arg| arg&.start_with?('-') }
+      if invalid_args.any?
+        raise ArgumentError, "Invalid #{arg_name}: '#{invalid_args.join("', '")}'"
+      end
+    end
+
     def diff_full(obj1 = 'HEAD', obj2 = nil, opts = {})
+      validate_no_options('commit or commit range', obj1, obj2)
+
       diff_opts = ['-p']
       diff_opts << obj1
       diff_opts << obj2 if obj2.is_a?(String)
@@ -536,6 +553,8 @@ def diff_full(obj1 = 'HEAD', obj2 = nil, opts = {})
     end
 
     def diff_stats(obj1 = 'HEAD', obj2 = nil, opts = {})
+      validate_no_options('commit or commit range', obj1, obj2)
+
       diff_opts = ['--numstat']
       diff_opts << obj1
       diff_opts << obj2 if obj2.is_a?(String)
@@ -556,6 +575,8 @@ def diff_stats(obj1 = 'HEAD', obj2 = nil, opts = {})
     end
 
     def diff_name_status(reference1 = nil, reference2 = nil, opts = {})
+      validate_no_options('commit or commit range', reference1, reference2)
+
       opts_arr = ['--name-status']
       opts_arr << reference1 if reference1
       opts_arr << reference2 if reference2
diff --git a/tests/units/test_diff.rb b/tests/units/test_diff.rb
@@ -118,5 +118,25 @@ def test_diff_each
     assert_equal(160, files['scott/newfile'].patch.size)
   end
 
+  def test_diff_patch_with_bad_commit
+    assert_raise(ArgumentError) do
+      @git.diff('-s').patch
+    end
 
+    assert_raise(ArgumentError) do
+      @git.diff('gitsearch1', '-s').patch
+    end
+  end
+
+  def test_diff_name_status_with_bad_commit
+    assert_raise(ArgumentError) do
+      @git.diff('-s').name_status
+    end
+  end
+
+  def test_diff_stats_with_bad_commit
+    assert_raise(ArgumentError) do
+      @git.diff('-s').stats
+    end
+  end
 end
