giturls

README

git-urls

Docs: pkg.go.dev/github.com/mojotx/git-urls

This module is forked from github.com/whilp/git-urls. The upstream project appears to be abandoned: security fixes submitted upstream, including whilp/git-urls#27, have remained open without review. This fork exists so important security issues can be fixed and released for downstream users.

Improvements over the original

• Fixes the regular-expression denial-of-service issue reported as GHSA-3f2q-6294-fmq5 by rejecting excessively long SCP-like URLs before running the regexp.
• Tightens SCP-style URL parsing so query data is only accepted after an actual ? separator.
• Uses a single anchored regexp match instead of collecting all matches for an input that can only match once.
• Adds regression tests for the URL length guard, valid SCP-like URLs, SCP-like URLs with query strings, and malformed trailing text.
• Updates the Go module path to github.com/mojotx/git-urls and publishes tagged releases for consumers that need the security fix.
• Updates project tooling from the obsolete gometalinter workflow to golangci-lint and Go module commands.

Documentation

Overview

Package giturls parses Git URLs.

These URLs include standard RFC 3986 URLs as well as special formats that are specific to Git. Examples are provided in the Git documentation at https://www.kernel.org/pub/software/scm/git/docs/git-clone.html.

Index

• Variables
• func Parse(rawurl string) (u *url.URL, err error)
• func ParseLocal(rawurl string) (*url.URL, error)
• func ParseScp(rawurl string) (*url.URL, error)
• func ParseTransport(rawurl string) (*url.URL, error)
• type Parser
• type TransportSet
  • func NewTransportSet(items ...string) *TransportSet
  • func (t *TransportSet) Valid(transport string) bool

Variables

var (

	// Transports is a set of known Git URL schemes.
	Transports = NewTransportSet(
		"ssh",
		"git",
		"git+ssh",
		"http",
		"https",
		"ftp",
		"ftps",
		"rsync",
		"file",
	)
)

Functions

func Parse

func Parse(rawurl string) (u *url.URL, err error)

Parse parses rawurl into a URL structure. Parse first attempts to find a standard URL with a valid Git transport as its scheme. If that cannot be found, it then attempts to find a SCP-like URL. And if that cannot be found, it assumes rawurl is a local path. If none of these rules apply, Parse returns an error.

func ParseLocal

func ParseLocal(rawurl string) (*url.URL, error)

ParseLocal parses rawurl into a URL object with a "file" scheme. This will effectively never return an error.

func ParseScp

func ParseScp(rawurl string) (*url.URL, error)

ParseScp parses rawurl into a URL object. The rawurl must be an SCP-like URL, otherwise ParseScp returns an error.

func ParseTransport

func ParseTransport(rawurl string) (*url.URL, error)

ParseTransport parses rawurl into a URL object. Unless the URL's scheme is a known Git transport, ParseTransport returns an error.

Types

type Parser

type Parser func(string) (*url.URL, error)

Parser converts a string into a URL.

type TransportSet

type TransportSet struct {
	Transports map[string]struct{}
}

TransportSet represents a set of valid Git transport schemes. It maps these schemes to empty structs, providing a set-like interface.

func NewTransportSet

func NewTransportSet(items ...string) *TransportSet

NewTransportSet returns a TransportSet with the items keys mapped to empty struct values.

func (*TransportSet) Valid

func (t *TransportSet) Valid(transport string) bool

Valid returns true if transport is a known Git URL scheme and false if not.