Via HackerOne. See https://hackerone.com/reports/1070247.
Some git commands accept both a ref selector (or some similar symbol) and a list of paths. For example:
$ git log <ref selector> -- <path> <path> ...
These commands use -- to disambiguate the ref selector from the paths. However, they have no mechanism for disambiguating the ref selector from the flags.
If a string like --example-flag is passed as a ref selector, Git may interpret it as a flag rather than a ref selector.
Affected commands include:
Although log can be invoked with --stdin to disambiguate flags, ref selectors, and paths, not all commands have a mode like this.