GHSA-whh4-5q6c-9v3x: GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle

GitPython 3.1.59 blocks a previously available local-file read path through unsafe git diff options such as -O/–orderfile.

However, the high-level diff API still permits –no-index with the default allow_unsafe_options=False.

–no-index changes the semantics of the paths arguments: instead of repository-relative pathspecs, Git interprets them as arbitrary filesystem paths.

When combined with the still-allowed -I/–ignore-matching-lines option, this creates a content-dependent Boolean oracle over a caller-selected local file.

This was reproduced against the published GitPython 3.1.59 wheel.

The original unsafe-option path is blocked in 3.1.59, while this alternate path remains reachable without setting allow_unsafe_options=True.