Re: [RFC PATCH 6/6] hex: allow only lowercase object IDs in breaking changes mode

On 2026-07-31 at 07:48:14, Junio C Hamano wrote:

"brian m. carlson" [off-list ref] writes:

quoted

Git has historically allowed either lowercase or uppercase hex for
object IDs, but it has always emitted only lowercase.  This has caused
people to expect only lowercase and not handle uppercase.

It is violation of Postel's Law by other people.  We do not
necessarily have to follow suit.

Postel's Law was a great idea on the early Internet, but it is
unfortunately no longer a good idea.  The problem is that being liberal
in what you accept these days usually has security implications.

TLS cannot be liberal in what it accepts because that means potentially
allowing attacker-controlled data.  Even HTTP cannot do that because
we've seen where refusing to reject requests with both Content-Length
and Transfer-Encoding: chunked means that two parts of a backend can
disagree on the content, allowing request smuggling.

We've seen these problems in our code where not caring about CR comes
back to bite us on Windows in a security-sensitive way.

Modern development effectively requires being clear and definitive about
what data is accepted and what is not, as well as what meaning is given
to the data that is accepted.

Even though I said throwing object names in a single category makes
sense, it may make sense to treat the object names that we locally
use to access our own object database and those that we use when
talking with _other_ people on the net separately for the Robustness
principle, we keep being strict in what we produce and stick to
lowercase, while accepting uppercase produced by those third-party
reimplementations of Git.

Unfortunately, that also doesn't fix most of the security problems I've
seen, which involve object IDs that get passed on the command line when
tools invoke Git.  It does fix the problem with round-tripping objects
between hash algorithms, though, but I don't really want to audit every
use of oid_to_hex in our codebase to half-fix this situation.
-- 
brian m. carlson (they/them)
Toronto, Ontario, CA