Skip to content

fix(sourcereader): exclude single-character URL schemes in Windows drive detection - #6380

Merged
shubpal07 merged 1 commit into
GoogleCloudPlatform:developfrom
shubpal07:shubham/harden-drive-path-detection
Sep 28, 2026
Merged

shubpal07 merged 1 commit into
GoogleCloudPlatform:developfrom
shubpal07:shubham/harden-drive-path-detection

Conversation

@shubpal07

Copy link
Copy Markdown
Contributor

Summary

Follow-up to #6325 addressing review feedback regarding Windows drive-letter path detection (isWindowsDrivePath).

Previously, isWindowsDrivePath matched any string starting with [A-Za-z]:, and IsLocalPath also fell back to filepath.IsAbs(source). This had two subtle edge cases:

  1. Single-character URI schemes (e.g., s://bucket/modules/vpc) or go-getter forced protocol prefixes (e.g., s::https://...) would be misclassified as local Windows drive paths.
  2. On Windows, Go's standard library filepath.IsAbs("s://bucket/modules/vpc") returns true (treating s: as a volume name and / as a path separator), bypassing scheme checks on Windows runners.

Changes

  • pkg/sourcereader/sourcereader.go:
    • Harden isWindowsDrivePath(cleanSource) to explicitly reject go-getter forced protocol syntax (cleanSource[2] == ':') and URI authority prefixes (strings.HasPrefix(cleanSource[2:], "//")).
    • Pass pre-normalized cleanSource from IsLocalPath into isWindowsDrivePath to avoid redundant string allocations.
    • Remove filepath.IsAbs(source) from IsLocalPath so local vs. remote path classification is 100% deterministic across Linux, macOS, and Windows (POSIX /, Windows UNC \\server\share, and drive paths C:\, C:/, C:path are all handled directly via cleanSource and isWindowsDrivePath).
    • Document the design tradeoffs for unnormalized multi-slash paths (C://foo) and single-character opaque URIs (s:manifest.json).
  • pkg/sourcereader/sourcereader_test.go:
    • Add unit test coverage in TestIsLocalPath, TestIsRemotePath, and TestFactory for drive roots (C:, C:\, C:/), UNC paths (\\server\share, //server/share), single-character schemes (s://, c://, s::), and boundary conditions.

Verification

  • Verified unit tests (./pkg/sourcereader/..., ./pkg/shell/..., ./pkg/modulereader/...) on both Linux and native Windows Server 2022 (go1.26.8 windows/amd64).
  • Verified gcluster.exe create and terraform validate on Windows Server 2022.

…ive detection

Change-Id: I46694e4e2739babce473855669e8e71f7fc9b91b
@shubpal07
shubpal07 requested a review from a team as a code owner September 26, 2026 06:12
@gemini-code-assist

Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request improves the reliability of Windows drive-letter path detection within the source reader. By refining the classification logic and removing reliance on platform-specific standard library functions, the changes ensure that remote URIs and local paths are correctly distinguished across all supported environments, addressing potential misclassifications in previous implementations.

Highlights

  • Windows Drive Detection Logic: Hardened the isWindowsDrivePath function to explicitly exclude single-character URL schemes and forced protocol prefixes, preventing misclassification of remote paths as local Windows drives.
  • Deterministic Path Classification: Removed filepath.IsAbs dependency in IsLocalPath to ensure consistent behavior across different operating systems, relying solely on normalized source paths.
  • Expanded Test Coverage: Added comprehensive unit tests for various edge cases, including UNC paths, drive roots, and single-character opaque URIs to ensure robust path handling.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request refactors the isWindowsDrivePath function in pkg/sourcereader/sourcereader.go to accept a normalized cleanSource path and adds robust checks to handle edge cases such as single-character URL schemes, forced protocol prefixes, and unnormalized multi-slash local paths. It also removes the unused path/filepath import and updates IsLocalPath accordingly. Additionally, comprehensive unit tests have been added to pkg/sourcereader/sourcereader_test.go to validate these changes against various local and remote path patterns. As there are no review comments, I have no additional feedback to provide.

@github-actions github-actions Bot assigned arpit974 and unassigned arpit974 Sep 26, 2026
@shubpal07 shubpal07 added the release-bugfix Added to release notes under the "Bug fixes" heading. label Sep 26, 2026

@ishitachail ishitachail left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@shubpal07
shubpal07 merged commit dcb7048 into GoogleCloudPlatform:develop Sep 28, 2026
34 of 97 checks passed
ep-nag pushed a commit to nagconsulting/cluster-toolkit that referenced this pull request Oct 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release-bugfix Added to release notes under the "Bug fixes" heading.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants