safe doesn't canonicalize paths

[thomasmitchell]

Maybe it should. My personal issue is /secret/... has vault try to redirect to secret/... but safe can't handle that.

[jhunt]

Specifically, this is happening when a POST is issued to a non-canonical URL, as in

safe x509 issue /secret/x --name foo

[jhunt]

Here is what is ultimately going on:

Vault is canonicalizing paths (at least to the generic backend) when you retrieve them, but not when you store them. Consider:

jhunt ~ →  safe write secret/x foo=quux
foo: quux
jhunt ~ →  safe read secret/x
--- # secret/x
foo: quux

jhunt ~ →  safe write secret///x foo=boz
foo: boz
jhunt ~ →  safe read secret///x
--- # secret///x
foo: quux

There is literally no way we will ever get back the foo=boz value we wrote in the second call to safe write; it's lost to the ages.

To fix this, safe will have to canonicalize all paths it sees by:

1. Stripping off leading and trailing forward slashes
2. Replacing contiguous runs of 2 or more forward slashes with a single forward slash