Merge pull request from GHSA-mq5p-2mcr-m52j

make positional args explicit

Author: consideRatio

nbgitpuller/pull.py

@@ -88,13 +88,13 @@ def branch_exists(self, branch):
         """
         try:
             heads = subprocess.run(
-                ["git", "ls-remote", "--heads", self.git_url],
+                ["git", "ls-remote", "--heads", "--", self.git_url],
                 capture_output=True,
                 text=True,
                 check=True
             )
             tags = subprocess.run(
-                ["git", "ls-remote", "--tags", self.git_url],
+                ["git", "ls-remote", "--tags", "--", self.git_url],
                 capture_output=True,
                 text=True,
                 check=True
@@ -118,7 +118,7 @@ def resolve_default_branch(self):
         """
         try:
             head_branch = subprocess.run(
-                ["git", "ls-remote", "--symref", self.git_url, "HEAD"],
+                ["git", "ls-remote", "--symref", "--", self.git_url, "HEAD"],
                 capture_output=True,
                 text=True,
                 check=True
@@ -154,7 +154,7 @@ def initialize_repo(self):
         if self.depth and self.depth > 0:
             clone_args.extend(['--depth', str(self.depth)])
         clone_args.extend(['--branch', self.branch_name])
-        clone_args.extend([self.git_url, self.repo_dir])
+        clone_args.extend(["--", self.git_url, self.repo_dir])
         yield from execute_cmd(clone_args)
         logging.info('Repo {} initialized'.format(self.repo_dir))