From: Junio C Hamano <gitster@pobox.com>
Date: Fri, 15 Jan 2016 23:03:17 GMT
Subject: Re: [PATCH] submodule: Port resolve_relative_url from shell to C
Message-ID: <xmqqlh7qfnt6.fsf@gitster.mtv.corp.google.com>
In-Reply-To: <CAGZ79kaBLmwfeMocKP+tQmqNLy0BDYTU9dFtMY6rmiTqNSi_Dg@mail.gmail.com>

Stefan Beller <sbeller@google.com> writes:

> On Fri, Jan 15, 2016 at 9:37 AM, Junio C Hamano <gitster@pobox.com> wrote:
>>>> It is somewhat hard to see how this avoids stripping one (or both)
>>>> slashes just after "http:" in remoteurl="http://site/path/", leaving
>>>> just "http:/" (or "http:").
>>>
>>> it would leave just 'http:/' if url were to be ../../some/where/else,
>>> such that the constructed url below would be http://some/where/else.
>>
>> Is that a good outcome, though?  Isn't it something we would want to
>> catch as an error?
>
> I would want to add theses checks later and for now
> just port over the code from shell to C. (The same issue
> is found in the shell code and nobody seems to bother so far)

Understood and I think that is a good direction to go.  Perhaps
leave a comment in the area to document it as a known bug (or a
NEEDSWORK) to make it more obvious and to help remember it?

Thanks.