Skip to content

git handler: 500 on double-slash in URL (PATH_INFO not normalized) #373

Description

@melvincarvalho

The git smart-HTTP handler doesn't normalize multi-slash sequences in the URL path before forwarding it as `PATH_INFO` to `git http-backend`. `http-backend` then rejects the path as "aliased" and JSS replies with a 500.

Same shape as #131 (double-slash → 500), but the fix in #360 only covered `src/utils/url.js`. `src/handlers/git.js` builds `urlPath` independently and was never updated.

Symptom

Frontend at jss.live/git/ accepts a repo URL with a trailing slash (e.g. `https://melvin.me/melvin/public/git/test/\`), then appends `/info/refs?service=git-upload-pack` to compose the smart-HTTP probe — yielding `/melvin/public/git/test//info/refs`. JSS forwards that path through to `git http-backend` unmodified.

pm2 stderr from the failing request on melvin.me running v0.0.170:

```
git http-backend stderr: fatal: '/melvin/public/git/test//info/refs': aliased
```

The browser sees `HTTP 500` and "Failed to load resource".

Reproduction

```bash

bare repo at test-repo.git/ — works

curl -sI 'https://melvin.me/melvin/public/git/test-repo.git/info/refs?service=git-upload-pack'

HTTP/2 200, application/x-git-upload-pack-advertisement

same repo, double slash injected — 500

curl -sI 'https://melvin.me/melvin/public/git/test-repo.git//info/refs?service=git-upload-pack'

HTTP/2 500

```

Fix

Collapse multi-slash sequences in `urlPath` at the top of `handleGit` (and reuse the cleaned value for `PATH_INFO`):

```js
let urlPath = decodeURIComponent(request.url.split('?')[0]);
urlPath = urlPath.replace(//{2,}/g, '/'); // mirror the fix in src/utils/url.js (#131)
```

Same regex `extractRepoPath` already does for the leading slash, but applied across the whole path so `PATH_INFO` is clean too.

Refs

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions