Commits on Jan 6, 2022

1. disallow abbreviated forms of full option names …

   Previously, due to default behavior of ArgumentParser, global --index-url,
   --extra-index-url, and --trusted-host options in requirements files could be
   abbreviated (e.g. "--index" == "--index-url"). As a result, unexpected
   behavior could occur during processing of a requirements file with these
   shortened option names when using Pipenv, which could be exploited by a
   malicious actor to surreptitiously insert pip options using non-obvious
   abbreviations.
   
   For example, adding a line with "--t example.com" to the
   requirements file would cause Pipenv to treat example.com as trusted, even
   when example.com presents an invalid TLS certificate.
   
   This commit disables support for abbreviated options in the ArgumentParser,
   to align Pipenv's behavior when parsing global options in a requirements
   file with the behavior in pip, as expected.

   

   milo-minderbinder committed Jan 6, 2022
   Copy the full SHA

   d535301 View commit details

   Browse the repository at this point in the history