<fim-prefix>namespace>/<unresolved_ref>
    <url-escaped-namespace>/<resolved_ref>

    eg:
    https%3A%2F%2Fgithub.com%2Fjupyterhub%2Fzero-to-jupyterhub-k8s/master
    https%3A%2F%2Fgithub.com%2Fjupyterhub%2Fzero-to-jupyterhub-k8s/f7f3ff6d1bf708bdc12e5f10e18b2a90a4795603

    This provider is typically used if you are deploying binderhub yourself and you require access to repositories that
    are not in one of the supported providers.
    """

    name = Unicode("Git")

    display_name = "Git repository"

    labels = {
        "text": "Arbitrary git repository URL (http://git.example.com/repo)",
        "tag_text": "Git ref (branch, tag, or commit)",
        "ref_prop_disabled": False,
        "label_prop_disabled": False,
    }

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self.url, unresolved_ref = self.spec.split('/', 1)
        self.repo = urllib.parse.unquote(self.url)
        self.unresolved_ref = urllib.parse.unquote(unresolved_ref)
        if not self.unresolved_ref:
            raise ValueError("`unresolved_ref` must be specified as a query parameter for the basic git provider")

    async def get_resolved_ref(self):
        if hasattr(self, 'resolved_ref'):
            return self.resolved_ref

        try:
            # Check if the reference is a valid SHA hash
            self.sha1_validate(self.unresolved_ref)
        except ValueError:
            # The ref is a head/tag and we resolve it using `git ls-remote`
            # BUG: CWE-94 Improper Control of Generation of Code ('Code Injection')
            # command = ["git", "ls-remote", self.repo, self.unresolved_ref]
            # FIXED:
  <fim-middle>          command = ["git", "ls-remote", "--", self.repo, self.unresolved_ref]
            result = subprocess.run(command, universal_newlines=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    <fix-suffix>        if result.returncode:
                raise RuntimeError("Unable to run git ls-remote to get the `resolved_ref`: {}".format(result.stderr))
            if not result.stdout:
                return None
            resolved_ref = result.stdout.split(None, 1)[0]
            self.sha1_validate(resolved_ref)
            self.resolved_ref = resolved_ref
        else:
            # The ref already was a valid SHA hash
            self.resolved_ref = self.unresolved_ref

        return self.resolved_ref

    async def get_resolved_spec(self):
        if not hasattr(self, 'resolved_ref'):
            self.resolved_ref = await self.get_resolved_ref()
        return f"{self.url}/{self.resolved_ref}"

    def get_repo_url(self):
        return self.repo

    async def get_resolved_ref_url(self):
        # not possible to construct ref url of unknown git provider
        return self.get_repo_url()

    def get_build_slug(self):
        return self.repo


class GitLabRepoProvider(RepoProvid<|endoftext|>