Skip to content

git handler: 500 on double-slash in URL (PATH_INFO not normalized) #373

Description

@melvincarvalho

The git smart-HTTP handler doesn't normalize multi-slash sequences in the URL path before forwarding it as `PATH_INFO` to `git http-backend`. `http-backend` then rejects the path as "aliased" and JSS replies with a 500.

Same shape as #131 (double-slash → 500), but the fix in #360 only covered `src/utils/url.js`. `src/handlers/git.js` builds `urlPath` independently and was never updated.

Symptom

Frontend at jss.live/git/ accepts a repo URL with a trailing slash (e.g. `https://melvin.me/melvin/public/git/test/\`), then appends `/info/refs?service=git-upload-pack` to compose the smart-HTTP probe — yielding `/melvin/public/git/test//info/refs`. JSS forwards that path through to `git http-backend` unmodified.

pm2 stderr from the failing request on melvin.me running v0.0.170:

```
git http-backend stderr: fatal: '/melvin/public/git/test//info/refs': aliased
```

The browser sees `HTTP 500` and "Failed to load resource".

Reproduction

```bash

bare repo at test-repo.git/ — works

curl -sI 'https://melvin.me/melvin/public/git/test-repo.git/info/refs?service=git-upload-pack'

HTTP/2 200, application/x-git-upload-pack-advertisement

same repo, double slash injected — 500

curl -sI 'https://melvin.me/melvin/public/git/test-repo.git//info/refs?service=git-upload-pack'

HTTP/2 500

```

Fix

Collapse multi-slash sequences in `urlPath` at the top of `handleGit` (and reuse the cleaned value for `PATH_INFO`):

```js
let urlPath = decodeURIComponent(request.url.split('?')[0]);
urlPath = urlPath.replace(//{2,}/g, '/'); // mirror the fix in src/utils/url.js (#131)
```

Same regex `extractRepoPath` already does for the leading slash, but applied across the whole path so `PATH_INFO` is clean too.

Refs

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions