Skip to content

Reject a Query String or Fragment in a Registry URL #912

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ptr727 merged 3 commits into from
Aug 22, 2026
Merged

Reject a Query String or Fragment in a Registry URL #912

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
40c3ece
Reject a Query String or Fragment in a Registry URL
ptr727 Aug 22, 2026
50afe89
Wrap a Comment Under the 100-Character Line Length
ptr727 Aug 22, 2026
3d1462e
Split a Wrapped Docstring Sentence, Add Owner-Segment URL Cases
ptr727 Aug 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions spec/audit.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,15 +255,16 @@ def owner_repos(owner):
page += 1


GITHUB_URL_RE = re.compile(r"^https://github\.com/([^/\s]+)/([^/\s]+?)(?:\.git)?/?$")
GITHUB_URL_RE = re.compile(r"^https://github\.com/([^/\s?#]+)/([^/\s?#]+?)(?:\.git)?/?$")


def repo_identity(url):
"""owner/repo, lowercased, parsed from a github.com URL, or None if it does not parse.

The canonical identity two repos are compared by, since a bare repo name collides across
owners and GitHub's own full_name field is already this exact shape (case-preserved). A
trailing .git is stripped so it still resolves to the same identity full_name would.
trailing .git is stripped so it still resolves to the same identity full_name would, and a
query string or fragment is rejected outright rather than folded into the repo name.
Comment thread
qodo-code-review[bot] marked this conversation as resolved.
Resolved
spec/validate.py rejects a url that fails to parse here at all, kept in sync with this regex.
"""
if not isinstance(url, str):
Expand Down Expand Up @@ -4212,6 +4213,9 @@ def _selftest():
(" https://github.com/owner/Repo ", "owner/repo"),
("https://github.com/owner/Repo.git", "owner/repo"),
("https://github.com/owner/Repo.github", "owner/repo.github"),
("https://github.com/owner/Repo?tab=readme", None),
("https://github.com/owner/Repo#readme", None),
("https://github.com/owner/Repo.git?tab=readme", None),
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Resolved
("https://github.com/owner/Repo", None),
("https://gitlab.com/owner/Repo", None),
("not a url", None),
Expand Down
3 changes: 2 additions & 1 deletion spec/validate.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,9 @@
CONSUMER_MODELS = ("push", "pull")
# Parses owner/repo, lowercased, from a repo's url.
# A trailing .git is stripped so it still matches GitHub's own full_name.
# A query character or a fragment character is excluded from both groups too, or a query string or fragment would fold into the repo name instead of failing to match.
Comment thread
ptr727 marked this conversation as resolved.
Resolved
# A duplicate identity here would let spec/audit.py's fleet membership check silently shadow one entry with the other.
GITHUB_URL_RE = re.compile(r"^https://github\.com/([^/\s]+)/([^/\s]+?)(?:\.git)?/?$")
GITHUB_URL_RE = re.compile(r"^https://github\.com/([^/\s?#]+)/([^/\s?#]+?)(?:\.git)?/?$")
# How faithfully a carried unit is checked, per spec/fidelity-model.md, defaulting to presence.
FIDELITIES = ("presence", "intent", "verbatim", "interface")
# The keys an interface unit's `contract` may carry (kept in sync with files.schema.json).
Expand Down