*: clone, resolve relative local URLs against CWD in CloneOptions.Validate#1891
Merged
Merged
Conversation
AriehSchneier
force-pushed
the
fix-relative-clone-url
branch
3 times, most recently
from
18368d6 to
f410dd2
Compare
AriehSchneier
force-pushed
the
fix-relative-clone-url
branch
2 times, most recently
from
0501e13 to
a17004f
Compare
AriehSchneier
force-pushed
the
fix-relative-clone-url
branch
8 times, most recently
from
496c425 to
a4e8d7e
Compare
pjbgf
reviewed
Mar 24, 2026
AriehSchneier
force-pushed
the
fix-relative-clone-url
branch
7 times, most recently
from
719bc65 to
ad59a5b
Compare
AriehSchneier
force-pushed
the
fix-relative-clone-url
branch
3 times, most recently
from
cee6d69 to
13fd8bc
Compare
AriehSchneier
force-pushed
the
fix-relative-clone-url
branch
3 times, most recently
from
6439da7 to
b9ea6e8
Compare
AriehSchneier
force-pushed
the
fix-relative-clone-url
branch
3 times, most recently
from
222e215 to
e4f9c97
Compare
AriehSchneier
force-pushed
the
fix-relative-clone-url
branch
2 times, most recently
from
96aa1ca to
ec85b0e
Compare
Contributor
Author
AriehSchneier
force-pushed
the
fix-relative-clone-url
branch
from
ec85b0e to
17d434c
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Resolves failures when cloning from ..-relative local paths (e.g. "../../repo") by normalizing such paths to absolute paths so the billy chroot-based filesystem loader does not reject them.
Changes:
- Update
CloneOptions.Validateto convert..-relative local URLs into absolute filesystem paths. - Add a regression test asserting
CloneOptions.Validatemakes..-relative URLs absolute.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
options.go |
Normalizes ..-relative local clone URLs to absolute paths during CloneOptions.Validate. |
options_test.go |
Adds regression coverage for CloneOptions.Validate handling of ..-relative URLs. |
…ptions.Validate When a caller passes a URL like "../../some-repo" to Clone, the billy chroot-based FilesystemLoader rejects any path whose cleaned form starts with ".." with "chroot boundary crossed". Fix: in CloneOptions.Validate, detect local-endpoint paths whose clean form starts with ".." and resolve them to absolute paths via filepath.Abs before any transport code runs. This matches the behaviour of `git clone`: relative paths are resolved against the caller's working directory at the command level, before handing the URL to the transport layer. Fixes: go-git#1723 Assisted-by: GitHub Copilot (claude-sonnet-4-6) <[email protected]> Signed-off-by: Arieh Schneier <[email protected]>
AriehSchneier
changed the title
AriehSchneier
force-pushed
the
fix-relative-clone-url
branch
from
17d434c to
4b82051
Compare
pjbgf
changed the title
pjbgf
approved these changes
Apr 29, 2026
pjbgf
left a comment
pjbgf
left a comment
Member
There was a problem hiding this comment.
@AriehSchneier thanks for working on this. 🙇
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a caller passes a URL like "../../some-repo" to Clone, the billy chroot-based FilesystemLoader rejects any path whose cleaned form starts with ".." ("chroot boundary crossed"), regardless of the chroot root.
Fix: in CloneOptions.Validate, detect local URLs whose cleaned form starts with ".." and resolve them to absolute paths via filepath.Abs before the URL reaches the transport layer. This matches the behaviour of
git clone: relative paths are resolved against the caller's working directory at the command level, before any transport code runs.Adds TestCloneOptionsValidate_RelativeDotDot as a regression test.
Note: This fix only applies to code paths that call CloneOptions.Validate (e.g., Repository.Clone). Direct calls to transport.NewEndpoint or transport.ParseURL will not have ../-relative paths normalized. A future PR may add normalization at the transport layer to cover all code paths.
Fixes: #1723