tree 666d98a45b2c548409712909e16df64ade1cd6c5
parent 12411d60875ebf2fa91a5ab065f048fb6183d098
author Jonas Finnemann Jensen <jonasfj@google.com> 1625772360 +0200
committer GitHub <noreply@github.com> 1625772360 +0200
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJg51FICRBK7hj4Ov3rIwAAKecIADJiuuPZe6OY/0i56/bgrOOb
 3LYDaWQ3vmBZdi/C57QiXWEq9Vh5CwRibPT159D1zxxfcNDsMX10wtV+QAFRWlW4
 q1647Fqyd3G45bQpl1XGhxjJlfLnQHbld+3VrOvyfWuqodi9bDOLgz5sZEXGOSXP
 Cbai+WF8ykICBwTS04pqUm9hFziwIQtuT+ZA984tNJlnkgkEDA0tZTZ0DcHVu3t/
 IsW5NV89dIpDo5PUnH6qPNUw0klOC3b3TSmPbCuOP7mjI1Vw+GKLs+i3/z8fFep3
 Unn3XLqUhMo0+3BkKhc62bWByRO4vq8JUSIKJmBfGq5U14kuY7x9nAfkXB1Hv+w=
 =LgvW
 -----END PGP SIGNATURE-----
 

Validate and normalize hosted url. (#3030)

* Validate and normalize hosted url.

We normalize the URL for a _hosted pub server_ to have no slash if the
server is just a bare domain like `https://example.com`, but if the URL
contains a path like `https://example.com/my-folder` then we always
normalize to `https://example.com/my-folder/`.

The reason for normalizing the URL is to improve consistency in
`pubspec.lock` and make it easier to implement authentication without
risks of being tricked by incorrect prefixes.

Additionally, be normalizing to no slash for empty paths, and paths
always ending in a slash when path is non-empty, we gain the benefit
that relative URLs can always be constructed correctly using
`hostedUrl.resolve('api/packages/$package')`.

This additionally forbids a few edge cases such as:
 * querystring in the hosted URL (`https://server.com/?query`),
 * fragment in the hosted URL (`https://server.com/#hash`),
 * user-info in the hosted URL (`https://user:pwd@server.com`).

These may have worked with previous versions of the `pub` client, but
most likely the _querystring_ or _fragment_ would cause URLs to be garbled.
Any user-info would likely have been ignored, this was not tested, any
usage of these options is considered unlikely.

Previously, `dart pub publish` would ignore the path in the hosted URL
and always upload to `/api/packages/new`. This commit fixes this issue.