)]}'
{
  "commit": "705db9bc77cf9bf8f82df76ac22338f6e745b4fb",
  "tree": "56d1a215db43a06cef014e79abca65cd3a74d125",
  "parents": [
    "957b0ac44549a70ccb951361b804d07d955aeb79"
  ],
  "author": {
    "name": "MalwareBro",
    "email": "106037584+MalwareBro@users.noreply.github.com",
    "time": "Mon Sep 07 13:19:09 2026 +0300"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Mon Sep 07 12:19:09 2026 +0200"
  },
  "message": "cherry_picker: validate commit IDs parsed from the issue body (#2816)\n\n### What\n\nValidate the commit IDs that `cherrypick_with_commits.py` parses out of\nthe issue body, accepting only git object names (7–40 hex characters).\n\n### Why\n\nThe on-demand cherry-pick flow reads commit IDs from the `### Commit\nIDs` section of the issue body:\n\n```python\nissue_body_dict[\"commits\"] \u003d get_middle_text(...).replace(\" \", \"\").split(\",\")\n```\n\nThat normalisation strips spaces and splits on commas, but it preserves\na leading dash. Each entry is then passed to git as an argv element:\n\n```python\nsubprocess.run([\"git\", \"diff-tree\", \"--no-commit-id\", \"--name-only\", commit_id, \"-r\", \"-m\"])\n```\n\nBecause `commit_id` sits in an argument position, a value such as\n`--output\u003d\u003cpath\u003e` is interpreted by git as an *option* rather than a\nrevision. `git diff-tree` honours `--output\u003d\u003cfile\u003e` and\ncreates/truncates that file, so a malformed entry can write to a path on\nthe runner instead of being rejected as an invalid revision. Relative\npaths are accepted, so the target is not confined to the checkout\ndirectory.\n\nThe commit IDs come from the issue body, which is user-authored content,\nso it seems worth constraining them to values git will only ever treat\nas revisions.\n\nThe existing `subprocess` calls already use list form without\n`shell\u003dTrue`, so there is no shell involved here — this is purely about\ngit\u0027s own option parsing.\n\n### How\n\nFilter empty entries (so a trailing comma stays tolerated) and require\neach remaining entry to match `^[0-9a-fA-F]{7,40}$`. Anything else is\nreported back on the issue using the existing `issue_comment` helper,\nfollowing the error-reporting style already used in this script, and the\nrun exits cleanly.\n\nVerified that the pattern accepts short (7) and full (40) hashes in\neither case, and rejects `--output\u003d...`, bare options such as `-r`,\nover-short values, and non-hex strings.",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "0cc9219a42f20243305704c9d709b8b8f36a7e34",
      "old_mode": 33188,
      "old_path": "actions/cherry_picker/cherrypick_with_commits.py",
      "new_id": "abe7a1c07faccbbb08322fa068ca8eaf6965e05f",
      "new_mode": 33188,
      "new_path": "actions/cherry_picker/cherrypick_with_commits.py"
    }
  ]
}