On Fri, Jul 3, 2015 at 6:26 PM, Sitaram Chamarty [off-list ref] wrote:
Jokes apart, I'm not sure the chances of *both* those things happening
-- an accidental hash-like string in the text *and* it matching an
existing hash -- are high enough to bother. If it can be done without
too much code, it probably should.
To be fair to the original implementor, I think we didn't have an API to ask
"do we have a committish object with this name?" with an abbreviated SHA-1.
All we had was "do we have an object with this name?".
As the only answer the command can give is an exteneded SHA-1 for
committish, it is understandable that hitting blobs and trees (which typically
are much more numerous than committishes) with false positives would have
been a real risk the implementation wanted to avoid.