Reject refcontainer values that are not 40 char sha or symref

dulwich/refs.py

@@ -377,6 +377,8 @@ class RefsContainer:
           name: The refname to set.
           ref: The new sha the refname will refer to.
         """
+        if not (valid_hexsha(ref) or ref.startswith(SYMREF)):
+            raise ValueError(f"{ref!r} must be a valid sha (40 chars) or a symref")
         self.set_if_equals(name, None, ref)
 
     def remove_if_equals(

tests/test_refs.py

@@ -210,6 +210,15 @@ class RefsContainerTests:
             b"42d06bd4b77fed026b154d16493e5deab78f02ec",
             self._refs[b"refs/some/ref"],
         )
+
+        # should accept symref
+        self._refs[b"refs/heads/symbolic"] = b"ref: refs/heads/master"
+        self.assertEqual(
+            b"42d06bd4b77fed026b154d16493e5deab78f02ec",
+            self._refs[b"refs/heads/symbolic"],
+        )
+
+        # should not accept bad ref names
         self.assertRaises(
             errors.RefFormatError,
             self._refs.__setitem__,
@@ -217,6 +226,14 @@ class RefsContainerTests:
             b"42d06bd4b77fed026b154d16493e5deab78f02ec",
         )
 
+        # should not accept short sha
+        self.assertRaises(
+            ValueError,
+            self._refs.__setitem__,
+            b"refs/some/ref",
+            b"42d06bd",
+        )
+
     def test_set_if_equals(self):
         nines = b"9" * 40
         self.assertFalse(self._refs.set_if_equals(b"HEAD", b"c0ffee", nines))