647f52
diff --git a/cache.h b/cache.h
647f52
index 94ca1ac..2ab9ffd 100644
647f52
--- a/cache.h
647f52
+++ b/cache.h
647f52
@@ -744,6 +744,14 @@ char *strip_path_suffix(const char *path, const char *suffix);
647f52
 int daemon_avoid_alias(const char *path);
647f52
 int offset_1st_component(const char *path);
647f52
 
647f52
+/*
647f52
+ * Returns true iff "str" could be confused as a command-line option when
647f52
+ * passed to a sub-program like "ssh". Note that this has nothing to do with
647f52
+ * shell-quoting, which should be handled separately; we're assuming here that
647f52
+ * the string makes it verbatim to the sub-program.
647f52
+ */
647f52
+int looks_like_command_line_option(const char *str);
647f52
+
647f52
 /* object replacement */
647f52
 #define READ_SHA1_FILE_REPLACE 1
647f52
 extern void *read_sha1_file_extended(const unsigned char *sha1, enum object_type *type, unsigned long *size, unsigned flag);
647f52
diff --git a/connect.c b/connect.c
647f52
index 6d4ea13..970f565 100644
647f52
--- a/connect.c
647f52
+++ b/connect.c
647f52
@@ -450,6 +450,11 @@ static struct child_process *git_proxy_connect(int fd[2], char *host)
647f52
 
647f52
 	get_host_and_port(&host, &port);
647f52
 
647f52
+	if (looks_like_command_line_option(host))
647f52
+		die("strange hostname '%s' blocked", host);
647f52
+	if (looks_like_command_line_option(port))
647f52
+		die("strange port '%s' blocked", port);
647f52
+
647f52
 	argv = xmalloc(sizeof(*argv) * 4);
647f52
 	argv[0] = git_proxy_command;
647f52
 	argv[1] = host;
647f52
@@ -613,6 +618,10 @@ struct child_process *git_connect(int fd[2], const char *url_orig,
647f52
 
647f52
 	conn = xcalloc(1, sizeof(*conn));
647f52
 
647f52
+	if (looks_like_command_line_option(path))
647f52
+		die("strange pathname '%s' blocked", path);
647f52
+
647f52
+
647f52
 	strbuf_init(&cmd, MAX_CMD_LEN);
647f52
 	strbuf_addstr(&cmd, prog);
647f52
 	strbuf_addch(&cmd, ' ');
647f52
@@ -626,6 +635,10 @@ struct child_process *git_connect(int fd[2], const char *url_orig,
647f52
 		const char *ssh = getenv("GIT_SSH");
647f52
 		int putty = ssh && strcasestr(ssh, "plink");
647f52
 		transport_check_allowed("ssh");
647f52
+		if (looks_like_command_line_option(host))
647f52
+			die("strange hostname '%s' blocked", host);
647f52
+
647f52
+
647f52
 		if (!ssh) ssh = "ssh";
647f52
 
647f52
 		*arg++ = ssh;
647f52
diff --git a/path.c b/path.c
647f52
index 04ff148..713d79b 100644
647f52
--- a/path.c
647f52
+++ b/path.c
647f52
@@ -701,3 +701,9 @@ int offset_1st_component(const char *path)
647f52
 		return 2 + is_dir_sep(path[2]);
647f52
 	return is_dir_sep(path[0]);
647f52
 }
647f52
+
647f52
+int looks_like_command_line_option(const char *str)
647f52
+{
647f52
+	return str && str[0] == '-';
647f52
+}
647f52
+
647f52
diff --git a/t/t5532-fetch-proxy.sh b/t/t5532-fetch-proxy.sh
647f52
index 5531bd1..d3b2651 100755
647f52
--- a/t/t5532-fetch-proxy.sh
647f52
+++ b/t/t5532-fetch-proxy.sh
647f52
@@ -40,4 +40,9 @@ test_expect_success 'fetch through proxy works' '
647f52
 	test_cmp expect actual
647f52
 '
647f52
 
647f52
+test_expect_success 'funny hostnames are rejected before running proxy' '
647f52
+	test_must_fail git fetch git://-remote/repo.git 2>stderr &&
647f52
+	! grep "proxying for" stderr
647f52
+'
647f52
+
647f52
 test_done