diff --git a/cache.h b/cache.h

index 1a2cec0b8..b9fc3a8e3 100644

--- a/cache.h

+++ b/cache.h

@@ -991,6 +991,14 @@ char *strip_path_suffix(const char *path, const char *suffix);

 int daemon_avoid_alias(const char *path);

 extern int is_ntfs_dotgit(const char *name);

+/*

+ * Returns true iff "str" could be confused as a command-line option when

+ * passed to a sub-program like "ssh". Note that this has nothing to do with

+ * shell-quoting, which should be handled separately; we're assuming here that

+ * the string makes it verbatim to the sub-program.

+ */

+int looks_like_command_line_option(const char *str);

+

 /**

  * Return a newly allocated string with the evaluation of

  * "$XDG_CONFIG_HOME/git/$filename" if $XDG_CONFIG_HOME is non-empty, otherwise

diff --git a/connect.c b/connect.c

index fd7ffe184..d77d39771 100644

--- a/connect.c

+++ b/connect.c

@@ -553,6 +553,11 @@ static struct child_process *git_proxy_connect(int fd[2], char *host)

 	get_host_and_port(&host, &port);

+	if (looks_like_command_line_option(host))

+		die("strange hostname '%s' blocked", host);

+	if (looks_like_command_line_option(port))

+		die("strange port '%s' blocked", port);

+

 	proxy = xmalloc(sizeof(*proxy));

 	child_process_init(proxy);

 	argv_array_push(&proxy->args, git_proxy_command);

@@ -722,6 +727,9 @@ struct child_process *git_connect(int fd[2], const char *url,

 		conn = xmalloc(sizeof(*conn));

 		child_process_init(conn);

+		if (looks_like_command_line_option(path))

+			die("strange pathname '%s' blocked", path);

+

 		strbuf_addstr(&cmd, prog);

 		strbuf_addch(&cmd, ' ');

 		sq_quote_buf(&cmd, path);

@@ -754,6 +762,9 @@ struct child_process *git_connect(int fd[2], const char *url,

 				return NULL;

 			}

+			if (looks_like_command_line_option(ssh_host))

+				die("strange hostname '%s' blocked", ssh_host);

+

 			ssh = getenv("GIT_SSH_COMMAND");

 			if (!ssh) {

 				const char *base;

diff --git a/path.c b/path.c

index 8b7e16812..b214ac3fe 100644

--- a/path.c

+++ b/path.c

@@ -1178,6 +1178,11 @@ int is_ntfs_dotgit(const char *name)

 		}

 }

+int looks_like_command_line_option(const char *str)

+{

+	return str && str[0] == '-';

+}

+

 char *xdg_config_home(const char *filename)

 {

 	const char *home, *config_home;

diff --git a/t/t5532-fetch-proxy.sh b/t/t5532-fetch-proxy.sh

index 5531bd1af..d3b2651b6 100755

--- a/t/t5532-fetch-proxy.sh

+++ b/t/t5532-fetch-proxy.sh

@@ -40,4 +40,9 @@ test_expect_success 'fetch through proxy works' '

 	test_cmp expect actual

 '

+test_expect_success 'funny hostnames are rejected before running proxy' '

+	test_must_fail git fetch git://-remote/repo.git 2>stderr &&

+	! grep "proxying for" stderr

+'

+

 test_done

diff --git a/t/t5810-proto-disable-local.sh b/t/t5810-proto-disable-local.sh

index 563592d8a..c1ef99b85 100755

--- a/t/t5810-proto-disable-local.sh

+++ b/t/t5810-proto-disable-local.sh

@@ -11,4 +11,27 @@ test_expect_success 'setup repository to clone' '

 test_proto "file://" file "file://$PWD"

 test_proto "path" file .

+test_expect_success 'setup repo with dash' '

+	git init --bare repo.git &&

+	git push repo.git HEAD &&

+	mv repo.git "$PWD/-repo.git"

+'

+

+# This will fail even without our rejection because upload-pack will

+# complain about the bogus option. So let's make sure that GIT_TRACE

+# doesn't show us even running upload-pack.

+#

+# We must also be sure to use "fetch" and not "clone" here, as the latter

+# actually canonicalizes our input into an absolute path (which is fine

+# to allow).

+test_expect_success 'repo names starting with dash are rejected' '

+	rm -f trace.out &&

+	test_must_fail env GIT_TRACE="$PWD/trace.out" git fetch -- -repo.git &&

+	! grep upload-pack trace.out

+'

+

+test_expect_success 'full paths still work' '

+	git fetch "$PWD/-repo.git"

+'

+

 test_done

diff --git a/t/t5813-proto-disable-ssh.sh b/t/t5813-proto-disable-ssh.sh

index a954ead8a..3f084ee30 100755

--- a/t/t5813-proto-disable-ssh.sh

+++ b/t/t5813-proto-disable-ssh.sh

@@ -17,4 +17,27 @@ test_proto "host:path" ssh "remote:repo.git"

 test_proto "ssh://" ssh "ssh://remote$PWD/remote/repo.git"

 test_proto "git+ssh://" ssh "git+ssh://remote$PWD/remote/repo.git"

+# Don't even bother setting up a "-remote" directory, as ssh would generally

+# complain about the bogus option rather than completing our request. Our

+# fake wrapper actually _can_ handle this case, but it's more robust to

+# simply confirm from its output that it did not run at all.

+test_expect_success 'hostnames starting with dash are rejected' '

+	test_must_fail git clone ssh://-remote/repo.git dash-host 2>stderr &&

+	! grep ^ssh: stderr

+'

+

+test_expect_success 'setup repo with dash' '

+	git init --bare remote/-repo.git &&

+	git push remote/-repo.git HEAD

+'

+

+test_expect_success 'repo names starting with dash are rejected' '

+	test_must_fail git clone remote:-repo.git dash-path 2>stderr &&

+	! grep ^ssh: stderr

+'

+

+test_expect_success 'full paths still work' '

+	git clone "remote:$PWD/remote/-repo.git" dash-path

+'

+

 test_done