Via HackerOne. See <https://hackerone.com/reports/1070247>.
Some `git` commands accept both a ref selector (or some similar symbol) and a list of paths. For example:
```
$ git log <ref selector> -- <path> <path> ...
```
These commands use `--` to disambiguate the ref selector from the paths. However, they have no mechanism for disambiguating the ref selector from the flags.
If a string like `--example-flag` is passed as a ref selector, Git may interpret it as a flag rather than a ref selector.
Affected commands include:
- `blame`
- `diff`
- `grep`
- `log`
- `ls-tree`
Although `log` can be invoked with `--stdin` to disambiguate flags, ref selectors, and paths, not all commands have a mode like this.