security: git tag create does not guard the tag name against a leading dash #710

New issue

Closed

opened 2026-10-04 18:20:36 +00:00 by hexajon · 0 comments

hexajon commented

2026-10-04 18:20:36 +00:00

Owner

What happens

madtea tag create passes the tag name into git tag argv with no leading-dash guard. In runTagCreate (internal/cmd/git/tag.go), name := args[0] (:152) is appended to gitArgs at :173, an optional commit ref (args[1]) at :177, then run via tagRunGit(ctx, gitArgs...) at :180. A name or commit ref beginning with - lands in option position and injects a flag into git tag. The existence check at :156 is safe (the name is prefixed with refs/tags/); the sink is :173/:177.

Scope

CLI surface (the value is the command's own argument), plus the madt_enable-gated tags MCP domain. A tag name never legitimately begins with -, so the fix is non-breaking. Surfaced by the #708 HTTP-client sweep; the push path already guards its sibling ref.

Fix (direction)

Reject a leading-dash name and commit ref before they reach argv (the ValidateRef guard the push/fetch/rebase paths use), or place -- before the positional arguments.

Acceptance criteria

git tag never receives a caller-controlled value in option position without a leading-dash guard or a -- terminator.
A test proves a --prefixed tag name is refused.

## What happens `madtea tag create` passes the tag name into `git tag` argv with no leading-dash guard. In `runTagCreate` (`internal/cmd/git/tag.go`), `name := args[0]` (`:152`) is appended to `gitArgs` at `:173`, an optional commit ref (`args[1]`) at `:177`, then run via `tagRunGit(ctx, gitArgs...)` at `:180`. A name or commit ref beginning with `-` lands in option position and injects a flag into `git tag`. The existence check at `:156` is safe (the name is prefixed with `refs/tags/`); the sink is `:173`/`:177`. ## Scope CLI surface (the value is the command's own argument), plus the `madt_enable`-gated `tags` MCP domain. A tag name never legitimately begins with `-`, so the fix is non-breaking. Surfaced by the #708 HTTP-client sweep; the push path already guards its sibling ref. ## Fix (direction) Reject a leading-dash `name` and commit ref before they reach argv (the `ValidateRef` guard the push/fetch/rebase paths use), or place `--` before the positional arguments. ## Acceptance criteria - [ ] `git tag` never receives a caller-controlled value in option position without a leading-dash guard or a `--` terminator. - [ ] A test proves a `-`-prefixed tag name is refused.

hexajon added the

security

severity/low

labels

2026-10-04 18:20:36 +00:00

hexajon added a new dependency

2026-10-05 12:34:15 +00:00

#675 epic: v0.20.0 - breaking: clearer ADR tooling and the write guard on every surface

~~hexajon referenced this issue 2026-10-05 12:34:16 +00:00~~

epic: v0.20.0 - breaking: clearer ADR tooling and the write guard on every surface #675

hexajon referenced this issue from a pull request that will close it,

2026-10-06 18:05:14 +00:00