Via HackerOne. See <https://hackerone.com/reports/1070247>.
Some `git` commands accept both a ref selector (or some similar symbol) and a list of paths. For example:
$ git log <ref selector> -- <path> <path> ...
These commands use `--` to disambiguate the ref selector from the paths. However, they have no mechanism for disambiguating the ref selector from the flags.
If a string like `--example-flag` is passed as a ref selector, Git may interpret it as a flag rather than a ref selector.
Affected commands include:
Although `log` can be invoked with `--stdin` to disambiguate flags, ref selectors, and paths, not all commands have a mode like this.