Merge pull request #8435 from Shopify/security-validate-git-author-7844826945563519319

[Security] Validate git commit author argument

Author: gonzaloriestra

packages/cli-kit/src/public/node/git.test.ts

@@ -277,6 +277,15 @@ describe('commit()', () => {
 
     expect(mockedExeca).toHaveBeenCalledWith('git', ['commit', '-m', 'msg', '--author', author], {cwd: directory})
   })
+
+  test('throws an error if author starts with a hyphen', async () => {
+    const author = '-invalid-author'
+
+    await expect(git.createGitCommit('msg', {author})).rejects.toThrowError(
+      /Invalid commit author: -invalid-author. Author name\/email can't start with a hyphen./,
+    )
+    expect(mockedExeca).not.toHaveBeenCalled()
+  })
 })
 
 describe('getHeadSymbolicRef()', () => {

packages/cli-kit/src/public/node/git.ts

@@ -299,6 +299,10 @@ export interface CreateGitCommitOptions {
 export async function createGitCommit(message: string, options?: CreateGitCommitOptions): Promise<string> {
   const args = ['commit', '-m', message]
   if (options?.author) {
+    // Guard against option injection attacks if author starts with '-'
+    if (options.author.startsWith('-')) {
+      throw new AbortError(`Invalid commit author: ${options.author}. Author name/email can't start with a hyphen.`)
+    }
     args.push('--author', options.author)
   }
   await gitCommand(args, options?.directory)