Subject: Re: [PATCH] submodule: Port resolve_relative_url from shell to C

From: Junio C Hamano <[email-masked]>
Date: Fri, 15 Jan 2016 09:37:26 -0800

Stefan Beller <[email-masked]> writes:

> On Wed, Jan 13, 2016 at 2:03 PM, Junio C Hamano <[email-masked]> wrote:
>> Stefan Beller <[email-masked]> writes:
>>> +     while (url) {
>>> +             if (starts_with_dot_dot_slash(url)) {
>>> +                     char *rfind;
>>> +                     url += 3;
>>> +
>>> +                     rfind = last_dir_separator(remoteurl);
>>> +                     if (rfind)
>>> +                             *rfind = '\0';
>>> +                     else {
>>> +                             rfind = strrchr(remoteurl, ':');
>>> +                             if (rfind) {
>>> +                                     *rfind = '\0';
>>> +                                     colonsep = 1;
>>> +                             } else {
>>> +                                     if (is_relative || !strcmp(".", remoteurl))
>>> +                                             die(_("cannot strip one component off url '%s'"), remoteurl);
>>> +                                     else
>>> +                                             remoteurl = xstrdup(".");
>>> +                             }
>>> +                     }
>>
>> It is somewhat hard to see how this avoids stripping one (or both)
>> slashes just after "http:" in remoteurl="http://site/path/", leaving
>> just "http:/" (or "http:").
>
> it would leave just 'http:/' if url were to be ../../some/where/else,
> such that the constructed url below would be http://some/where/else.

Is that a good outcome, though?  Isn't it something we would want to
catch as an error?