From: Junio C Hamano <gitster@pobox.com>
Date: Fri, 15 Jan 2016 17:37:26 GMT
Subject: Re: [PATCH] submodule: Port resolve_relative_url from shell to C
Message-ID: <xmqqwpraiw15.fsf@gitster.mtv.corp.google.com>
In-Reply-To: <CAGZ79ka0rxYK7GRSjh13XOsg887EgqYtc5B60z9qU=tAoJGERQ@mail.gmail.com>

Stefan Beller <sbeller@google.com> writes:

> On Wed, Jan 13, 2016 at 2:03 PM, Junio C Hamano <gitster@pobox.com> wrote:
>> Stefan Beller <sbeller@google.com> writes:
>>> +     while (url) {
>>> +             if (starts_with_dot_dot_slash(url)) {
>>> +                     char *rfind;
>>> +                     url += 3;
>>> +
>>> +                     rfind = last_dir_separator(remoteurl);
>>> +                     if (rfind)
>>> +                             *rfind = '\0';
>>> +                     else {
>>> +                             rfind = strrchr(remoteurl, ':');
>>> +                             if (rfind) {
>>> +                                     *rfind = '\0';
>>> +                                     colonsep = 1;
>>> +                             } else {
>>> +                                     if (is_relative || !strcmp(".", remoteurl))
>>> +                                             die(_("cannot strip one component off url '%s'"), remoteurl);
>>> +                                     else
>>> +                                             remoteurl = xstrdup(".");
>>> +                             }
>>> +                     }
>>
>> It is somewhat hard to see how this avoids stripping one (or both)
>> slashes just after "http:" in remoteurl="http://site/path/", leaving
>> just "http:/" (or "http:").
>
> it would leave just 'http:/' if url were to be ../../some/where/else,
> such that the constructed url below would be http://some/where/else.

Is that a good outcome, though?  Isn't it something we would want to
catch as an error?