[zanecodes]

Sometimes you're using git in a context where you don't control the filenames, or where a potential attacker could influence or fully control them, at which point edge cases like this can easily turn into exploits.

I also chafe whenever I run into artificial restrictions on things like characters in names of things, because there's no good reason for them besides the laziness of developers or the limitations and inertia of existing systems that might be used under the hood, like DNS for instance.

[vips7L]

An attacker has access to your git??? You’re fucked. Give up.

[kangalioo]

Every git repository hosting platform - GitHub, GitLab, Bitbucket, Codeberg - necessarily gives end users control over filenames.

"User-controlled strings as parameters" is not "access to your git" but it is still an attack vector.