isomorphic-git 1.40.6 → 1.40.8

package/managers/index.cjs

@@ -3097,8 +3097,10 @@ class UrlParseError extends BaseError {
 UrlParseError.code = 'UrlParseError';
 
 function translateSSHtoHTTP(url) {
-  // handle "shorter scp-like syntax"
-  url = url.replace(/^git@([^:]+):/, 'https://$1/');
+  // handle "shorter scp-like syntax". The user is dropped: it names an ssh
+  // account and means nothing over https, which is what the old expression did
+  // for `git@` too.
+  url = url.replace(/^[^/@:]+@([^/@:]+):/, 'https://$1/');
   // handle proper SSH URLs
   url = url.replace(/^ssh:\/\//, 'https://');
   return url
@@ -3145,9 +3147,15 @@ class GitRemoteManager {
  * @param {string} args.url - The URL of the remote repository.
  * @returns {Object|undefined} - An object containing the transport and address, or undefined if parsing fails.
  */
+// git-clone(1) calls this the "shorter scp-like syntax": [user@]host:path. The
+// user is part of the syntax, not part of the word `git`, and a self-hosted
+// forge is as likely to hand out `gitolite@`, `forgejo@` or `ubuntu@`. The host
+// and the user cannot hold a slash, an at sign or a colon, so `https://x` and a
+// `scheme:address` override are left to the expression below.
+const scpLike = /^[^/@:]+@[^/@:]+:/;
+
 function parseRemoteUrl({ url }) {
-  // the stupid "shorter scp-like syntax"
-  if (url.startsWith('git@')) {
+  if (scpLike.test(url)) {
     return {
       transport: 'ssh',
       address: url,

package/managers/index.js

@@ -3090,8 +3090,10 @@ class UrlParseError extends BaseError {
 UrlParseError.code = 'UrlParseError';
 
 function translateSSHtoHTTP(url) {
-  // handle "shorter scp-like syntax"
-  url = url.replace(/^git@([^:]+):/, 'https://$1/');
+  // handle "shorter scp-like syntax". The user is dropped: it names an ssh
+  // account and means nothing over https, which is what the old expression did
+  // for `git@` too.
+  url = url.replace(/^[^/@:]+@([^/@:]+):/, 'https://$1/');
   // handle proper SSH URLs
   url = url.replace(/^ssh:\/\//, 'https://');
   return url
@@ -3138,9 +3140,15 @@ class GitRemoteManager {
  * @param {string} args.url - The URL of the remote repository.
  * @returns {Object|undefined} - An object containing the transport and address, or undefined if parsing fails.
  */
+// git-clone(1) calls this the "shorter scp-like syntax": [user@]host:path. The
+// user is part of the syntax, not part of the word `git`, and a self-hosted
+// forge is as likely to hand out `gitolite@`, `forgejo@` or `ubuntu@`. The host
+// and the user cannot hold a slash, an at sign or a colon, so `https://x` and a
+// `scheme:address` override are left to the expression below.
+const scpLike = /^[^/@:]+@[^/@:]+:/;
+
 function parseRemoteUrl({ url }) {
-  // the stupid "shorter scp-like syntax"
-  if (url.startsWith('git@')) {
+  if (scpLike.test(url)) {
     return {
       transport: 'ssh',
       address: url,