The git smart-HTTP handler doesn't normalize multi-slash sequences in the URL path before forwarding it as `PATH_INFO` to `git http-backend`. `http-backend` then rejects the path as "aliased" and JSS replies with a 500.
Same shape as #131 (double-slash → 500), but the fix in #360 only covered `src/utils/url.js`. `src/handlers/git.js` builds `urlPath` independently and was never updated.
Symptom
Frontend at jss.live/git/ accepts a repo URL with a trailing slash (e.g. `https://melvin.me/melvin/public/git/test/\`), then appends `/info/refs?service=git-upload-pack` to compose the smart-HTTP probe — yielding `/melvin/public/git/test//info/refs`. JSS forwards that path through to `git http-backend` unmodified.
pm2 stderr from the failing request on melvin.me running v0.0.170:
```
git http-backend stderr: fatal: '/melvin/public/git/test//info/refs': aliased
```
The browser sees `HTTP 500` and "Failed to load resource".
Reproduction
```bash
bare repo at test-repo.git/ — works
curl -sI 'https://melvin.me/melvin/public/git/test-repo.git/info/refs?service=git-upload-pack'
HTTP/2 200, application/x-git-upload-pack-advertisement
same repo, double slash injected — 500
curl -sI 'https://melvin.me/melvin/public/git/test-repo.git//info/refs?service=git-upload-pack'
HTTP/2 500
```
Fix
Collapse multi-slash sequences in `urlPath` at the top of `handleGit` (and reuse the cleaned value for `PATH_INFO`):
```js
let urlPath = decodeURIComponent(request.url.split('?')[0]);
urlPath = urlPath.replace(//{2,}/g, '/'); // mirror the fix in src/utils/url.js (#131)
```
Same regex `extractRepoPath` already does for the leading slash, but applied across the whole path so `PATH_INFO` is clean too.
Refs
The git smart-HTTP handler doesn't normalize multi-slash sequences in the URL path before forwarding it as `PATH_INFO` to `git http-backend`. `http-backend` then rejects the path as "aliased" and JSS replies with a 500.
Same shape as #131 (double-slash → 500), but the fix in #360 only covered `src/utils/url.js`. `src/handlers/git.js` builds `urlPath` independently and was never updated.
Symptom
Frontend at jss.live/git/ accepts a repo URL with a trailing slash (e.g. `https://melvin.me/melvin/public/git/test/\`), then appends `/info/refs?service=git-upload-pack` to compose the smart-HTTP probe — yielding `/melvin/public/git/test//info/refs`. JSS forwards that path through to `git http-backend` unmodified.
pm2 stderr from the failing request on melvin.me running v0.0.170:
```
git http-backend stderr: fatal: '/melvin/public/git/test//info/refs': aliased
```
The browser sees `HTTP 500` and "Failed to load resource".
Reproduction
```bash
bare repo at test-repo.git/ — works
curl -sI 'https://melvin.me/melvin/public/git/test-repo.git/info/refs?service=git-upload-pack'
HTTP/2 200, application/x-git-upload-pack-advertisement
same repo, double slash injected — 500
curl -sI 'https://melvin.me/melvin/public/git/test-repo.git//info/refs?service=git-upload-pack'
HTTP/2 500
```
Fix
Collapse multi-slash sequences in `urlPath` at the top of `handleGit` (and reuse the cleaned value for `PATH_INFO`):
```js
let urlPath = decodeURIComponent(request.url.split('?')[0]);
urlPath = urlPath.replace(//{2,}/g, '/'); // mirror the fix in src/utils/url.js (#131)
```
Same regex `extractRepoPath` already does for the leading slash, but applied across the whole path so `PATH_INFO` is clean too.
Refs
git-protocolheader in CORS preflight responses #371 — `Git-Protocol` CORS header (recently shipped in v0.0.170)