Sanitize and Escape refs in git backend (#21464)

modules/git/git.go

@@ -25,7 +25,7 @@ import (
 )
 
 // GitVersionRequired is the minimum Git version required
-const GitVersionRequired = "2.0.0"
+const GitVersionRequired = "2.24.0"
 
 var (
 	// GitExecutable is the command name of git
@@ -117,8 +117,7 @@ func VersionInfo() string {
 	}
 	format := "%s"
 	args := []interface{}{gitVersion.Original()}
-	// Since git wire protocol has been released from git v2.18
-	if setting.Git.EnableAutoGitWireProtocol && CheckGitVersionAtLeast("2.18") == nil {
+	if setting.Git.EnableAutoGitWireProtocol {
 		format += ", Wire Protocol %s Enabled"
 		args = append(args, "Version 2") // for focus color
 	}

modules/git/repo_commit.go

@@ -158,7 +158,7 @@ func (repo *Repository) searchCommits(id SHA1, opts SearchCommitsOptions) ([]*Co
 				// add previous arguments except for --grep and --all
 				hashCmd.AddArguments(args...)
 				// add keyword as <commit>
-				hashCmd.AddArguments(v)
+				hashCmd.AddArguments("--end-of-options", v)
 
 				// search with given constraints for commit matching sha hash of v
 				hashMatching, _, err := hashCmd.RunStdBytes(&RunOpts{Dir: repo.Path})
@@ -208,9 +208,10 @@ func (repo *Repository) CommitsByFileAndRange(revision, file string, page int) (
 	}()
 	go func() {
 		stderr := strings.Builder{}
-		err := NewCommand(repo.Ctx, "log", revision, "--follow",
+		err := NewCommand(repo.Ctx, "log", prettyLogFormat, "--follow",
 			"--max-count="+strconv.Itoa(setting.Git.CommitsRangeSize*page),
-			prettyLogFormat, "--", file).
+			"--end-of-options", revision,
+			"--", file).
 			Run(&RunOpts{
 				Dir:    repo.Path,
 				Stdout: stdoutWriter,

modules/git/repo_stats.go

@@ -63,7 +63,7 @@ func (repo *Repository) GetCodeActivityStats(fromTime time.Time, branch string)
 	if len(branch) == 0 {
 		args = append(args, "--branches=*")
 	} else {
-		args = append(args, "--first-parent", branch)
+		args = append(args, "--first-parent", "--", branch)
 	}
 
 	stderr := new(strings.Builder)