fix(remote): reject option-shaped pull operands

<!-- agent -->
`Remote.pull()` validated keyword options but forwarded refspecs through
`git pull`, whose internal fetch invocation loses the `--` separator.
GHSA-f9j4-qggq-h239 reports the resulting positional validation bypass.

Reject all leading-dash refspecs and remote names before spawning Git,
rather than trying to enumerate dangerous option spellings. This also
applies with `allow_unsafe_options=True`: explicit options still belong in
keyword arguments. Document the behavior and add an unreleased changelog
entry. No shell quoting change is needed; the problem is Git's own option
parsing, not splitting arguments in Python.

Git reference: `builtin/pull.c:run_fetch()` at Git commit
`12cb6293d6288865c1a133cf22accbaf99d13eb6` forwards the remote and refspecs
without an option terminator. Tested with Apple Git 2.54.0.

Assisted-by: GPT 6.0
Co-authored-by: GPT 6.0 <codex@openai.com>

Author: Byron

doc/source/changes.rst

@@ -9,6 +9,7 @@ Security fixes for
 
 * https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-gq48-pqfc-9p58
 * https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2
+* https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239
 
 If you can, also try and provide feedback on the upcoming v4 branch
 https://github.com/gitpython-developers/GitPython/pull/2177 - patches welcome.

git/remote.py

@@ -14,7 +14,7 @@
 from git.cmd import Git, handle_process_output
 from git.compat import defenc, force_text
 from git.config import GitConfigParser, SectionConstraint, cp
-from git.exc import GitCommandError
+from git.exc import GitCommandError, UnsafeOptionError
 from git.refs import Head, Reference, RemoteReference, SymbolicReference, TagReference
 from git.util import (
     CallableRemoteProgress,
@@ -1101,7 +1101,8 @@ def pull(
         merge of branch with your local branch.
 
         :param refspec:
-            See :meth:`fetch` method.
+            See :meth:`fetch` method. Values starting with ``-`` are rejected,
+            even when ``allow_unsafe_options`` is enabled. Pass options as keywords.
 
         :param progress:
             See :meth:`push` method.
@@ -1127,6 +1128,12 @@ def pull(
         kwargs = add_progress(kwargs, self.repo.git, progress)
 
         refspec = Git._unpack_args(refspec or [])
+        # Git pull forwards these operands to fetch without preserving `--`.
+        # Reject every option-shaped operand, including with unsafe options enabled:
+        # opting into an explicit option must not turn a refspec into an option.
+        for operand in [self.name, *refspec]:
+            if operand.startswith("-"):
+                raise UnsafeOptionError("Remote names and pull refspecs must not start with '-'.")
         if not allow_unsafe_protocols:
             for ref in refspec:
                 Git.check_unsafe_protocols(ref)

test/test_positional_args.py

@@ -0,0 +1,42 @@
+"""High-level operands must not become Git options."""
+
+from unittest import mock
+
+import pytest
+
+from git import Git, Remote, Repo
+from git.exc import UnsafeOptionError
+
+
+@pytest.mark.parametrize("allow_unsafe_options", [False, True])
+@pytest.mark.parametrize(
+    "refspec",
+    ["--upload-pack=helper", ["--upl=helper"], ["main", "--dry-run"], "-uhelper", "--arg value", "--"],
+)
+def test_pull_rejects_option_shaped_refspec(tmp_path, refspec, allow_unsafe_options):
+    repo = Repo.init(tmp_path)
+    remote = Remote(repo, "origin")
+    with mock.patch.object(Git, "_call_process", side_effect=AssertionError("Git must not run")) as run:
+        with pytest.raises(UnsafeOptionError):
+            remote.pull(refspec, allow_unsafe_options=allow_unsafe_options)
+        run.assert_not_called()
+
+
+def test_pull_rejects_option_shaped_remote(tmp_path):
+    repo = Repo.init(tmp_path)
+    remote = Remote(repo, "--upload-pack=helper")
+    with mock.patch.object(Git, "_call_process", side_effect=AssertionError("Git must not run")) as run:
+        with pytest.raises(UnsafeOptionError):
+            remote.pull("main")
+        run.assert_not_called()
+
+
+def test_pull_preserves_operand_and_explicit_option_values(tmp_path):
+    repo = Repo.init(tmp_path)
+    remote = Remote(repo, "origin")
+    with mock.patch.object(Git, "_call_process") as run, mock.patch.object(
+        Remote, "_get_fetch_info_from_stderr", return_value=[]
+    ):
+        remote.pull("refs/heads/topic", upload_pack="helper with spaces", allow_unsafe_options=True)
+    assert run.call_args[0] == ("pull", "--", remote, ["refs/heads/topic"])
+    assert run.call_args[1]["upload_pack"] == "helper with spaces"