Repository navigation
Skip unusable .gitignore lines instead of aborting the scan - #51
Merged
Merged
Conversation
The entry said only that the floor avoids a vulnerable Click release. It now names CVE-2026-7246 (GHSA-47fr-3ffg-hgmw): command injection through the filename argument of click.edit(), which launches the editor through a shell (CWE-78), and moves under a Security heading. panopticas does not call click.edit() and neither do its other dependencies, so it was not itself exploitable. The floor matters because >=8.3.1 admitted the affected 8.3.1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A line pathspec cannot compile, such as a character range written backwards or a lone backslash, raised out of load_gitignore_patterns() and took the whole scan with it. A .gitignore that was not valid UTF-8 raised UnicodeDecodeError the same way. Git accepts all three, skips what it cannot use and applies the rest. Patterns are now compiled one line at a time and a line that fails is skipped, with order preserved so a later negation still overrides an earlier match. The file is read with errors='replace'. A .gitignore with no such lines produces the same matcher as before. Closes #50 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #50.
Summary
.gitignoreline panopticas cannot process is now skipped, and the rest of the file still applies. Previously it aborted the whole scan with a traceback..gitignorethat is not valid UTF-8 no longer aborts the scan either.The bug
.gitignorecontenta[b-a]c— a character range written backwardsre.error: bad character range\— a lone backslashGitIgnorePatternError: Invalid git patternUnicodeDecodeErrorload_gitignore_patterns()opened the file as strict UTF-8 and handed every line to pathspec in one call, catching nothing.assess,urls,aiand every caller ofidentify_files()failed on a repository Git handles without complaint. Not a regression: the matcher replaced in #25 failed the same way.The fix
_ignore_spec()compiles patterns one line at a time and skips a line that raisesValueError(pathspec'sGitIgnorePatternErroris a subclass) orre.error. Order is preserved, because a later negation overrides an earlier match.load_gitignore_patterns()opens the file witherrors='replace'.Skipping is silent, as it is in Git.
Testing
pytest -W error::DeprecationWarning: 780 passed, on pathspec 1.1.1 and on 1.0.0.TestMalformedGitignorecovers all three cases, a negation line after the bad one, and that the built-in exclusions survive. All six tests failed before the change.find_files()selects exactly the same files before and after, confirming that compiling line by line changes nothing for a well-formed.gitignore.Not changed
A
.gitignorethat cannot be opened at all, such as a directory with that name, still raises.The Click changelog entry
The existing entry said only that the floor avoids "a vulnerable Click release". It now sits under a
### Securityheading and names CVE-2026-7246 (GHSA-47fr-3ffg-hgmw): command injection through the filename argument ofclick.edit(), which launches the editor through a shell (CWE-78). panopticas does not callclick.edit(), and neither do its other dependencies, so it was not itself exploitable; the floor matters because>=8.3.1admitted the affected 8.3.1. No code or dependency change in that commit.🤖 Generated with Claude Code