You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Right now, when the plugin sets up the persistent storage location for TUF metadata in the context of a particular repository, it uses this line of code to name the directory:
preg_replace('/[^[:alnum:]\.]/', '-', $repoUrl)
This can be problematic because URLs like site.coop.info/packages and site.coop/info/packages will collide. This is probably something of an edge case, but it's enough of a concern that it should block a 1.0.0 release of this plugin. We need to find a better way to name these directories.
One option is to use a SHA-256 hash of the URL, but that could be quite obscure. Other thoughts welcome...
The text was updated successfully, but these errors were encountered:
Use a true escaping method that doesn't create collisions. For example, I think URL encoding may provide a conservative subset of what a filename is allowed to contain.
Combine the current naming with a hash, eliminating collision risk while preserving readability for most purposes. I would put the hash later in the name to improve sorting and tab completion experiences.
I slightly prefer the latter, as the readable part remains more readable/tab-completable. The common case won't be collision, anyway.
Combine the current naming with a hash, eliminating collision risk while preserving readability for most purposes. I would put the hash later in the name to improve sorting and tab completion experiences.
Right now, when the plugin sets up the persistent storage location for TUF metadata in the context of a particular repository, it uses this line of code to name the directory:
This can be problematic because URLs like
site.coop.info/packages
andsite.coop/info/packages
will collide. This is probably something of an edge case, but it's enough of a concern that it should block a 1.0.0 release of this plugin. We need to find a better way to name these directories.One option is to use a SHA-256 hash of the URL, but that could be quite obscure. Other thoughts welcome...
The text was updated successfully, but these errors were encountered: