rasterstate/fj
rasterstate/fj
Watch
8
0
Fork
You've already forked fj
 0
Code Issues 23 Pull requests Releases 7 Activity Actions

Reject scp-form remote URLs with a stray colon in the path #89

Merged
stephen merged 1 commit from fix/remote-scp-colon-owner into main 2026-06-08 12:14:20 +00:00
Conversation 0 Commits 1 Files changed 1 +17 -1
stephen commented 2026-06-08 05:13:02 +00:00
Owner
Copy link

The scp-form remote parser (`git@host:owner/name`) splits on the first colon, so a URL carrying an extra colon, for example `git@host:2222:owner/name` (a port mistakenly placed in scp syntax), silently parsed `owner` as `2222:owner`. `fj` would then operate against the wrong repository path instead of reporting the URL as malformed, which is dangerous for any write command.

A real owner or name never contains a colon, so reject one in `split_path`. Adds a regression test for the multi-colon scp case.

The scp-form remote parser (\`git@host:owner/name\`) splits on the first colon, so a URL carrying an extra colon, for example \`git@host:2222:owner/name\` (a port mistakenly placed in scp syntax), silently parsed \`owner\` as \`2222:owner\`. \`fj\` would then operate against the wrong repository path instead of reporting the URL as malformed, which is dangerous for any write command. A real owner or name never contains a colon, so reject one in \`split_path\`. Adds a regression test for the multi-colon scp case.
Reject scp-form remote URLs with a stray colon in the path
All checks were successful
ci / check (pull_request) Successful in 9m43s
Details
ci / live-e2e (pull_request) Successful in 1m47s
Details
ci / coverage (pull_request) Successful in 1m54s
Details
b8e3b0622d 
The scp-form parser (`git@host:owner/name`) splits on the first colon, so a
URL with an extra colon such as `git@host:2222:owner/name` silently produced
owner `2222:owner` and went on to target the wrong repository. A real owner or
name never contains a colon, so reject one in split_path instead of operating
against a misparsed repo. Adds a regression test.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backlog
Accepted but not scheduled

  
blocked
Blocked or stalled waiting on external progress

  
converted
Converted into tracked work

  
forseti:changes-requested
Forseti review found unaddressed findings; cleared on a clean re-review at the current head.

  
opportunity
Potential product or business opportunity

  
p1
Priority 1

  
p2
Priority 2

  
p3
Priority 3

  
parked
Paused intentionally until later

No labels
backlog
blocked
converted
forseti:changes-requested
opportunity
p1
p2
p3
parked
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rasterstate/fj!89
No description provided.