SWE-Bench Multilingual Images Leak Git Tags

[ConnorBAdams]

Describe the bug

The SWE-Bench Multilingual images leak the git tags, this is similar in shape to the future commit issue from SWE-bench/SWE-bench#465 but not as severe. The SWE-Bench Verified images seem to have this patched, but Multilingual is lacking patches.

Realistically this is a pretty unlikely abuse vector, but an agent could stumble on it and abuse it.

Steps/Code to Reproduce

Step-by-step reproduction with a public image:

1. Pull the image:

docker pull --platform linux/amd64 swebench/sweb.eval.x86_64.axios_1776_axios-4738:latest

2. Docker interactive with no network to showcase it's all in the container

docker run --rm -it --network none --platform linux/amd64 --entrypoint bash swebench/sweb.eval.x86_64.axios_1776_axios-4738:latest

3. Current commits

rev-parse HEAD
git show -s --format='%cI  %s' HEAD

Provides:

9bb016f95e6de871a44f3276fd06562704a0abb0
2022-05-28T11:37:01+02:00  chore: updated actions to run on new version based branches

So anything beyond 2022-05-28 could leak the solution

4. Future commits on branches are pruned

git for-each-ref refs/remotes/ | wc -l
git config --get remote.origin.url

Provides:

0

Shows that future branches are clean

5. Abuse tags

git for-each-ref refs/tags/ | wc -l
git for-each-ref --format='%(refname:short)' refs/tags/ | tail -10
git log --all --oneline ^HEAD | wc -l 

Returns:

116
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.9.0
515

We have 515 reachable commits and just to showcase it further:

git for-each-ref --format='%(refname:short) %(*committerdate:iso-strict)%(committerdate:iso-strict)' refs/tags/ | sort -k2 -r | head -5

Yields:

v1.9.0 2025-04-24T23:18:14+03:00
v0.30.0 2025-03-26T19:50:22+02:00
v1.8.4 2025-03-19T21:26:49+02:00
v1.8.3 2025-03-12T09:23:22+02:00
v1.8.2 2025-03-07T09:40:33+02:00

For example a model could run:

git show v1.9.0 | head -60

to see:

tag v1.9.0
Tagger: DigitalBrainJS <DigitalBrainJS@users.noreply.github.com>
Date:   Thu Apr 24 20:18:53 2025 +0000

Release v1.9.0

commit cdcfd214c169a1acba8e267ab8e77ff4dfec3105
Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Date:   Thu Apr 24 23:18:14 2025 +0300

    chore(release): v1.9.0 (#6891)
    
    Co-authored-by: DigitalBrainJS <12586868+DigitalBrainJS@users.noreply.github.com>

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18ccfeb..f7248aa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,32 @@
 # Changelog
 
+# [1.9.0](https://github.com/axios/axios/compare/v1.8.4...v1.9.0) (2025-04-24)
+
+
+### Bug Fixes
+
+* **core:** fix the Axios constructor implementation to treat the config argument as optional; ([#6881](https://github.com/axios/axios/issues/6881)) ([6c5d4cd](https://github.com/axios/axios/commit/6c5d4cd69286868059c5e52d45085cb9a894a983))
+* **fetch:** fixed ERR_NETWORK mapping for Safari browsers; ([#6767](https://github.com/axios/axios/issues/6767)) ([dfe8411](https://github.com/axios/axios/commit/dfe8411c9a082c3d068bdd1f8d6e73054f387f45))
+* **headers:** allow iterable objects to be a data source for the set method; ([#6873](https://github.com/axios/axios/issues/6873)) ([1b1f9cc](https://github.com/axios/axios/commit/1b1f9ccdc15f1ea745160ec9a5223de9db4673bc))
+* **headers:** fix `getSetCookie` by using 'get' method for caseless access; ([#6874](https://github.com/axios/axios/issues/6874)) ([d4f7df4](https://github.com/axios/axios/commit/d4f7df4b304af8b373488fdf8e830793ff843eb9))
+* **headers:** fixed support for setting multiple header values from an iterated source; ([#6885](https://github.com/axios/axios/issues/6885)) ([f7a3b5e](https://github.com/axios/axios/commit/f7a3b5e0f7e5e127b97defa92a132fbf1b55cf15))
+* **http:** send minimal end multipart boundary ([#6661](https://github.com/axios/axios/issues/6661)) ([987d2e2](https://github.com/axios/axios/commit/987d2e2dd3b362757550f36eab875e60640b6ddc))
+* **types:** fix autocomplete for adapter config ([#6855](https://github.com/axios/axios/issues/6855)) ([e61a893](https://github.com/axios/axios/commit/e61a8934d8f94dd429a2f309b48c67307c700df0))
+
+
+### Features
+
+* **AxiosHeaders:** add getSetCookie method to retrieve set-cookie headers values ([#5707](https://github.com/axios/axios/issues/5707)) ([80ea756](https://github.com/axios/axios/commit/80ea756e72bcf53110fa792f5d7ab76e8b11c996))
+
+### Contributors to this release
+
+- <img src="https://avatars.githubusercontent.com/u/12586868?v&#x3D;4&amp;s&#x3D;18" alt="avatar" width="18"/> [Dmitriy Mozgovoy](https://github.com/DigitalBrainJS "+200/-34 (#6890 #6889 #6888 #6885 #6881 #6767 #6874 #6873 )")
+- <img src="https://avatars.githubusercontent.com/u/4814473?v&#x3D;4&amp;s&#x3D;18" alt="avatar" width="18"/> [Jay](https://github.com/jasonsaayman "+26/-1 ()")
+- <img src="https://avatars.githubusercontent.com/u/22686401?v&#x3D;4&amp;s&#x3D;18" alt="avatar" width="18"/> [Willian Agostini](https://github.com/WillianAgostini "+21/-0 (#5707 )")
+- <img src="https://avatars.githubusercontent.com/u/2500247?v&#x3D;4&amp;s&#x3D;18" alt="avatar" width="18"/> [George Cheng](https://github.com/Gerhut "+3/-3 (#5096 )")
+- <img src="https://avatars.githubusercontent.com/u/30260221?v&#x3D;4&amp;s&#x3D;18" alt="avatar" width="18"/> [FatahChan](https://github.com/FatahChan "+2/-2 (#6855 )")
+- <img src="https://avatars.githubusercontent.com/u/49002?v&#x3D;4&amp;s&#x3D;18" alt="avatar" width="18"/> [Ionuț G. Stan](https://github.com/igstan "+1/-1 (#6661 )")
+
 ## [1.8.4](https://github.com/axios/axios/compare/v1.8.3...v1.8.4) (2025-03-19)
 
 
diff --git a/bower.json b/bower.json
index 44fef3e..f572736 100644
--- a/bower.json
+++ b/bower.json
@@ -1,7 +1,7 @@
 {
   "name": "axios",
   "main": "./dist/axios.js",
-  "version": "1.8.4",

and to exploit this particular case, the model could just run:

git log --all --oneline --grep='#4738'

which gives:

a11f950 Fix/4737/timeout error message for http (#4738)

Then git show a11f950 which leaks the full solution:

commit a11f9501b823a167de7187ee542e4204ad1a517a
Author: Victor Augusto <vdbernardes@gmail.com>
Date:   Sat May 28 06:46:33 2022 -0300

    Fix/4737/timeout error message for http (#4738)
    
    * Fixing timeoutErrorMessage in http calls
    
    When timeoutErrorMessage was set this did not change anything in the error message, with this change the error message will be the configured message
    
    * Testing timeoutErrorMessage in http calls
    
    When timeoutErrorMessage was set this did not change anything in the error message, with this change the error message will be the configured message
    
    Co-authored-by: Jay <jasonsaayman@gmail.com>

diff --git a/lib/adapters/http.js b/lib/adapters/http.js
index 8d3588b..fc87251 100755
--- a/lib/adapters/http.js
+++ b/lib/adapters/http.js
@@ -420,9 +420,13 @@ module.exports = function httpAdapter(config) {
       // ClientRequest.setTimeout will be fired on the specify milliseconds, and can make sure that abort() will be fired after connect.
       req.setTimeout(timeout, function handleRequestTimeout() {
         req.abort();
+        var timeoutErrorMessage = config.timeout ? 'timeout of ' + config.timeout + 'ms exceeded' : 'timeout exceeded';
         var transitional = config.transitional || transitionalDefaults;
+        if (config.timeoutErrorMessage) {
+          timeoutErrorMessage = config.timeoutErrorMessage;
+        }
         reject(new AxiosError(
-          'timeout of ' + timeout + 'ms exceeded',
+          timeoutErrorMessage,
           transitional.clarifyTimeoutError ? AxiosError.ETIMEDOUT : AxiosError.ECONNABORTED,
           config,
           req
diff --git a/test/unit/adapters/http.js b/test/unit/adapters/http.js
....

Expected Results

These should yield nothing like searching for future commits does, otherwise agents can find this info and exploit it.

Actual Results

N/A

System Information

N/A