Skip to content

Commit 3776fa5

Browse files
ybiquitousisaacs
ybiquitous
authored and
isaacs
committed
fix(git-host): disallow URI-encoded slash (%2F) in path
PR-URL: #44 Credit: @ybiquitous Close: #44 Reviewed-by: @isaacs
1 parent b681019 commit 3776fa5

File tree

6 files changed

+30
-1
lines changed

6 files changed

+30
-1
lines changed

‎git-host.js‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,14 @@ GitHost.prototype._fill = function (template, opts) {
3838
var rawPath = vars.path
3939
var rawProject = vars.project
4040
Object.keys(vars).forEach(function (key) {
41-
vars[key] = encodeURIComponent(vars[key])
41+
var value = vars[key]
42+
if (key === 'path' && typeof value === 'string') {
43+
vars[key] = value.split('/').map(function (pathComponent) {
44+
return encodeURIComponent(pathComponent)
45+
}).join('/')
46+
} else {
47+
vars[key] = encodeURIComponent(value)
48+
}
4249
})
4350
vars['auth@'] = rawAuth ? rawAuth + '@' : ''
4451
vars['#fragment'] = rawFragment ? '#' + this.hashformat(rawFragment) : ''

‎test/bitbucket.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,18 @@ test('fromUrl(bitbucket url)', function (t) {
1010
if (!hostinfo) return
1111
t.is(hostinfo.https(), 'git+https://bitbucket.org/111/222.git' + hash, label + ' -> https')
1212
t.is(hostinfo.browse(), 'https://bitbucket.org/111/222' + (branch ? '/src/' + branch : ''), label + ' -> browse')
13+
t.is(hostinfo.browse(''), 'https://bitbucket.org/111/222/src/' + (branch || 'master') + '/', label + ' -> browse(path)')
1314
t.is(hostinfo.browse('C'), 'https://bitbucket.org/111/222/src/' + (branch || 'master') + '/C', label + ' -> browse(path)')
15+
t.is(hostinfo.browse('C/D'), 'https://bitbucket.org/111/222/src/' + (branch || 'master') + '/C/D', label + ' -> browse(path)')
1416
t.is(hostinfo.browse('C', 'A'), 'https://bitbucket.org/111/222/src/' + (branch || 'master') + '/C#a', label + ' -> browse(path, fragment)')
17+
t.is(hostinfo.browse('C/D', 'A'), 'https://bitbucket.org/111/222/src/' + (branch || 'master') + '/C/D#a', label + ' -> browse(path, fragment)')
1518
t.is(hostinfo.docs(), 'https://bitbucket.org/111/222' + (branch ? '/src/' + branch : '') + '#readme', label + ' -> docs')
1619
t.is(hostinfo.ssh(), '[email protected]:111/222.git' + hash, label + ' -> ssh')
1720
t.is(hostinfo.sshurl(), 'git+ssh://[email protected]/111/222.git' + hash, label + ' -> sshurl')
1821
t.is(hostinfo.shortcut(), 'bitbucket:111/222' + hash, label + ' -> shortcut')
22+
t.is(hostinfo.file(''), 'https://bitbucket.org/111/222/raw/' + (branch || 'master') + '/', label + ' -> file')
1923
t.is(hostinfo.file('C'), 'https://bitbucket.org/111/222/raw/' + (branch || 'master') + '/C', label + ' -> file')
24+
t.is(hostinfo.file('C/D'), 'https://bitbucket.org/111/222/raw/' + (branch || 'master') + '/C/D', label + ' -> file')
2025
t.is(hostinfo.tarball(), 'https://bitbucket.org/111/222/get/' + (branch || 'master') + '.tar.gz', label + ' -> tarball')
2126
}
2227

‎test/gist.js‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,18 @@ test('fromUrl(gist url)', function (t) {
1313
t.is(hostinfo.git(), 'git://gist.github.com/' + proj + '.git' + hash, label + ' -> git')
1414
t.is(hostinfo.browse(), 'https://gist.github.com/' + proj + (branch ? '/' + branch : ''), label + ' -> browse')
1515
t.is(hostinfo.browse('C'), 'https://gist.github.com/' + proj + (branch ? '/' + branch : '') + '#file-c', label + ' -> browse(path)')
16+
t.is(hostinfo.browse('C/D'), 'https://gist.github.com/' + proj + (branch ? '/' + branch : '') + '#file-cd', label + ' -> browse(path)')
1617
t.is(hostinfo.browse('C', 'A'), 'https://gist.github.com/' + proj + (branch ? '/' + branch : '') + '#file-c', label + ' -> browse(path, fragment)')
18+
t.is(hostinfo.browse('C/D', 'A'), 'https://gist.github.com/' + proj + (branch ? '/' + branch : '') + '#file-cd', label + ' -> browse(path)')
1719
t.is(hostinfo.bugs(), 'https://gist.github.com/' + proj, label + ' -> bugs')
1820
t.is(hostinfo.docs(), 'https://gist.github.com/' + proj + (branch ? '/' + branch : ''), label + ' -> docs')
1921
t.is(hostinfo.ssh(), '[email protected]:/' + proj + '.git' + hash, label + ' -> ssh')
2022
t.is(hostinfo.sshurl(), 'git+ssh://[email protected]/' + proj + '.git' + hash, label + ' -> sshurl')
2123
t.is(hostinfo.shortcut(), 'gist:' + proj + hash, label + ' -> shortcut')
2224
if (hostinfo.user) {
25+
t.is(hostinfo.file(''), 'https://gist.githubusercontent.com/111/' + proj + '/raw/' + (branch ? branch + '/' : ''), label + ' -> file')
2326
t.is(hostinfo.file('C'), 'https://gist.githubusercontent.com/111/' + proj + '/raw/' + (branch ? branch + '/' : '') + 'C', label + ' -> file')
27+
t.is(hostinfo.file('C/D'), 'https://gist.githubusercontent.com/111/' + proj + '/raw/' + (branch ? branch + '/' : '') + 'C/D', label + ' -> file')
2428
t.is(hostinfo.tarball(), 'https://gist.github.com/111/' + proj + '/archive/' + (branch || 'master') + '.tar.gz', label + ' -> tarball')
2529
}
2630
}

‎test/github.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,11 @@ test('fromUrl(github url)', function (t) {
1313
t.is(hostinfo.https(), 'git+https://github.com/111/222.git' + hash, label + ' -> https')
1414
t.is(hostinfo.git(), 'git://github.com/111/222.git' + hash, label + ' -> git')
1515
t.is(hostinfo.browse(), 'https://github.com/111/222' + treebranch, label + ' -> browse')
16+
t.is(hostinfo.browse(''), 'https://github.com/111/222/tree/' + (branch || 'master') + '/', label + ' -> browse("")')
1617
t.is(hostinfo.browse('C'), 'https://github.com/111/222/tree/' + (branch || 'master') + '/C', label + ' -> browse(path)')
18+
t.is(hostinfo.browse('C/D'), 'https://github.com/111/222/tree/' + (branch || 'master') + '/C/D', label + ' -> browse(path)')
1719
t.is(hostinfo.browse('C', 'A'), 'https://github.com/111/222/tree/' + (branch || 'master') + '/C#a', label + ' -> browse(path, fragment)')
20+
t.is(hostinfo.browse('C/D', 'A'), 'https://github.com/111/222/tree/' + (branch || 'master') + '/C/D#a', label + ' -> browse(path, fragment)')
1821
t.is(hostinfo.bugs(), 'https://github.com/111/222/issues', label + ' -> bugs')
1922
t.is(hostinfo.docs(), 'https://github.com/111/222' + treebranch + '#readme', label + ' -> docs')
2023
t.is(hostinfo.ssh(), '[email protected]:111/222.git' + hash, label + ' -> ssh')
@@ -24,7 +27,9 @@ test('fromUrl(github url)', function (t) {
2427
t.is(hostinfo.hash(), hash, ' -> hash')
2528
t.is(hostinfo.path({ noCommittish: true }), '111/222', ' -> path (no committish)')
2629
t.is(hostinfo.shortcut(), 'github:111/222' + hash, label + ' -> shortcut')
30+
t.is(hostinfo.file(''), 'https://raw.githubusercontent.com/111/222/' + (branch || 'master') + '/', label + ' -> file')
2731
t.is(hostinfo.file('C'), 'https://raw.githubusercontent.com/111/222/' + (branch || 'master') + '/C', label + ' -> file')
32+
t.is(hostinfo.file('C/D'), 'https://raw.githubusercontent.com/111/222/' + (branch || 'master') + '/C/D', label + ' -> file')
2833
t.is(hostinfo.tarball(), 'https://codeload.github.com/111/222/tar.gz/' + (branch || 'master'), label + ' -> tarball')
2934
}
3035

‎test/gitlab.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,18 @@ test('fromUrl(gitlab url)', function (t) {
1010
if (!hostinfo) return
1111
t.is(hostinfo.https(), 'git+https://gitlab.com/111/222.git' + hash, label + ' -> https')
1212
t.is(hostinfo.browse(), 'https://gitlab.com/111/222' + (branch ? '/tree/' + branch : ''), label + ' -> browse')
13+
t.is(hostinfo.browse(''), 'https://gitlab.com/111/222/tree/' + (branch || 'master') + '/', label + ' -> browse(path)')
1314
t.is(hostinfo.browse('C'), 'https://gitlab.com/111/222/tree/' + (branch || 'master') + '/C', label + ' -> browse(path)')
15+
t.is(hostinfo.browse('C/D'), 'https://gitlab.com/111/222/tree/' + (branch || 'master') + '/C/D', label + ' -> browse(path)')
1416
t.is(hostinfo.browse('C', 'A'), 'https://gitlab.com/111/222/tree/' + (branch || 'master') + '/C#a', label + ' -> browse(path, fragment)')
17+
t.is(hostinfo.browse('C/D', 'A'), 'https://gitlab.com/111/222/tree/' + (branch || 'master') + '/C/D#a', label + ' -> browse(path, fragment)')
1518
t.is(hostinfo.docs(), 'https://gitlab.com/111/222' + (branch ? '/tree/' + branch : '') + '#readme', label + ' -> docs')
1619
t.is(hostinfo.ssh(), '[email protected]:111/222.git' + hash, label + ' -> ssh')
1720
t.is(hostinfo.sshurl(), 'git+ssh://[email protected]/111/222.git' + hash, label + ' -> sshurl')
1821
t.is(hostinfo.shortcut(), 'gitlab:111/222' + hash, label + ' -> shortcut')
22+
t.is(hostinfo.file(''), 'https://gitlab.com/111/222/raw/' + (branch || 'master') + '/', label + ' -> file')
1923
t.is(hostinfo.file('C'), 'https://gitlab.com/111/222/raw/' + (branch || 'master') + '/C', label + ' -> file')
24+
t.is(hostinfo.file('C/D'), 'https://gitlab.com/111/222/raw/' + (branch || 'master') + '/C/D', label + ' -> file')
2025
t.is(hostinfo.tarball(), 'https://gitlab.com/111/222/repository/archive.tar.gz?ref=' + (branch || 'master'), label + ' -> tarball')
2126
}
2227

‎test/https-with-inline-auth.js‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,16 @@ test('HTTPS GitHub URL with embedded auth -- generally not a good idea', functio
1212
t.is(hostinfo.git(), 'git://user:[email protected]/111/222.git' + hash, label + ' -> git')
1313
t.is(hostinfo.browse(), 'https://github.com/111/222' + (branch ? '/tree/' + branch : ''), label + ' -> browse')
1414
t.is(hostinfo.browse('C'), 'https://github.com/111/222/tree/' + (branch || 'master') + '/C', label + ' -> browse(path)')
15+
t.is(hostinfo.browse('C/D'), 'https://github.com/111/222/tree/' + (branch || 'master') + '/C/D', label + ' -> browse(path)')
1516
t.is(hostinfo.browse('C', 'A'), 'https://github.com/111/222/tree/' + (branch || 'master') + '/C#a', label + ' -> browse(path, fragment)')
17+
t.is(hostinfo.browse('C/D', 'A'), 'https://github.com/111/222/tree/' + (branch || 'master') + '/C/D#a', label + ' -> browse(path, fragment)')
1618
t.is(hostinfo.bugs(), 'https://github.com/111/222/issues', label + ' -> bugs')
1719
t.is(hostinfo.docs(), 'https://github.com/111/222' + (branch ? '/tree/' + branch : '') + '#readme', label + ' -> docs')
1820
t.is(hostinfo.ssh(), '[email protected]:111/222.git' + hash, label + ' -> ssh')
1921
t.is(hostinfo.sshurl(), 'git+ssh://[email protected]/111/222.git' + hash, label + ' -> sshurl')
2022
t.is(hostinfo.shortcut(), 'github:111/222' + hash, label + ' -> shortcut')
2123
t.is(hostinfo.file('C'), 'https://user:[email protected]/111/222/' + (branch || 'master') + '/C', label + ' -> file')
24+
t.is(hostinfo.file('C/D'), 'https://user:[email protected]/111/222/' + (branch || 'master') + '/C/D', label + ' -> file')
2225
}
2326

2427
// insecure protocols

0 commit comments

Comments
 (0)