Merge pull request #4885 from annasong20/contain-ldr-path

Contain `RepoSpec` path in repo

api/internal/git/repospec.go

@@ -93,6 +93,11 @@ func NewRepoSpecFromURL(n string) (*RepoSpec, error) {
 	if host == "" {
 		return nil, fmt.Errorf("url lacks host: %s", n)
 	}
+	cleanedPath := filepath.Clean(strings.TrimPrefix(path, string(filepath.Separator)))
+	if pathElements := strings.Split(cleanedPath, string(filepath.Separator)); len(pathElements) > 0 &&
+		pathElements[0] == filesys.ParentDir {
+		return nil, fmt.Errorf("url path exits repo: %s", n)
+	}
 	return &RepoSpec{
 		raw: n, Host: host, OrgRepo: orgRepo,
 		Dir: notCloned, Path: path, Ref: gitRef, GitSuffix: suffix,

api/internal/git/repospec_test.go

@@ -101,6 +101,10 @@ func TestNewRepoSpecFromUrlErrors(t *testing.T) {
 			"https://host?ref=group/version/minor_version",
 			"url lacks orgRepo",
 		},
+		"path_exits_repo": {
+			"https://github.com/org/repo.git//path/../../exits/repo",
+			"url path exits repo",
+		},
 	}
 
 	for name, testCase := range badData {