{"version":"2.1.234","anchor":"git-remote-hostnames-validated-more-strictly","canonical_anchor":"git-remote-hostnames-validated-more-strictly","heading":"Git remote hostnames validated more strictly","tier":"notice","area":"Git","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/git-remote-hostnames-validated-more-strictly","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### Git remote hostnames validated more strictly\n\nHostnames pulled from git remotes are validated more strictly so a crafted URL can't look like a flag.\n\n**What**\n\nA hostname parsed out of a git remote URL must now consist only of letters, digits, dots and hyphens and must not start with a hyphen, on top of the existing checks for a dot and an alphabetic top-level domain. This stops a crafted remote URL from producing a host that later looks like a command-line option.\n\n**Evidence**\n\n`\/^[A-Za-z0-9.-]+$\/`\n\n- Area: Git\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}