[pkgsite] internal/vuln: add convertFileURLPath on Windows

0 views

Skip to first unread message

Michael Matloob (Gerrit)

unread,

Mar 17, 2026, 12:42:07 PM (yesterday) Mar 17

to Michael Matloob, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, kokoro, Go LUCI, Gopher Robot, Ethan Lee, golang-co...@googlegroups.com

Michael Matloob submitted the change with unreviewed changes

Unreviewed changes

1 is the latest approved patch-set.
The change was submitted with unreviewed changes in the following files:

```
The name of the file: internal/vuln/url_other.go
Insertions: 1, Deletions: 1.

@@ -1,4 +1,4 @@
-// Copyright 2019 The Go Authors. All rights reserved.
+// Copyright 2026 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
```
```
The name of the file: internal/vuln/url_windows.go
Insertions: 3, Deletions: 3.

@@ -29,7 +29,7 @@
 		// We do not support that format, but we should at least emit a more
 		// helpful error message for it.
 		if filepath.VolumeName(host) != "" {
-			return "", errors.New("file URL encodes volume in host field: too few slashes?")
+			return "", errors.New("file URL encodes drive letter in host field (example file:///C:/path)")
 		}
 		return `\\` + host + path, nil
 	}
@@ -37,7 +37,7 @@
 	// If host is empty, path must contain an initial slash followed by a
 	// drive letter and path. Remove the slash and verify that the path is valid.
 	if vol := filepath.VolumeName(path[1:]); vol == "" || strings.HasPrefix(vol, `\\`) {
-		return "", errors.New("file URL missing drive letter")
+		return "", errors.New("file URL missing drive letter (e.g., file:///C:/path)")
 	}
-	return path[1:], nil
+	return filepath.Clean(path[1:]), nil
 }
```

Change information

Commit message:

internal/vuln: add convertFileURLPath on Windows

This addresses bcmills's comment in CL 508503.

Change-Id: I528465feb074c220ca2fc8a1f50eb6c1376f6b75

Reviewed-on: https://go-review.googlesource.com/c/pkgsite/+/755581

LUCI-TryBot-Result: Go LUCI <golang...@luci-project-accounts.iam.gserviceaccount.com>

Reviewed-by: Ethan Lee <etha...@google.com>

Reviewed-by: Michael Matloob <mat...@google.com>

Auto-Submit: Michael Matloob <mat...@golang.org>

Run-TryBot: Michael Matloob <mat...@google.com>

kokoro-CI: kokoro <noreply...@google.com>

TryBot-Bypass: Michael Matloob <mat...@google.com>

Files:

M internal/vuln/source_test.go
M internal/vuln/url.go
A internal/vuln/url_other.go
M internal/vuln/url_test.go
A internal/vuln/url_windows.go

Change size: M

Delta: 5 files changed, 65 insertions(+), 18 deletions(-)

Branch: refs/heads/master

Submit Requirements:

Code-Review: +1 by Michael Matloob, +2 by Ethan Lee
Legacy-TryBots-Pass: Run-TryBot+1 by Michael Matloob, TryBot-Bypass+1 by Michael Matloob
TryBots-Pass: LUCI-TryBot-Result+1 by Go LUCI, TryBot-Bypass+1 by Michael Matloob
kokoro-CI-Passes: kokoro-CI+1 by kokoro, TryBot-Bypass+1 by Michael Matloob

Open in Gerrit

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

open

diffy

satisfied_requirement

Reply all

Reply to author

Forward

0 new messages