From efc021ee1fbe63511d1d51cde9fd6abaa18813df Mon Sep 17 00:00:00 2001
From: Tangled <noreply@tangled.sh>
Date: Tue, 18 Mar 2025 16:53:14 +0000
Subject: [PATCH] fix routing into tags/branches with slashes in them

path-extractor in the router should use an escaped path
---
 appview/state/middleware.go | 4 ++--
 knotserver/routes.go        | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/appview/state/middleware.go b/appview/state/middleware.go
index e1c35f2..4a6d26c 100644
--- a/appview/state/middleware.go
+++ b/appview/state/middleware.go
@@ -165,9 +165,9 @@ func RepoPermissionMiddleware(s *State, requiredPerm string) Middleware {
 
 func StripLeadingAt(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		path := req.URL.Path
+		path := req.URL.EscapedPath()
 		if strings.HasPrefix(path, "/@") {
-			req.URL.Path = "/" + strings.TrimPrefix(path, "/@")
+			req.URL.RawPath = "/" + strings.TrimPrefix(path, "/@")
 		}
 		next.ServeHTTP(w, req)
 	})
diff --git a/knotserver/routes.go b/knotserver/routes.go
index fb1a054..2929953 100644
--- a/knotserver/routes.go
+++ b/knotserver/routes.go
@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"log"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -34,6 +35,7 @@ func (h *Handle) RepoIndex(w http.ResponseWriter, r *http.Request) {
 	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
 	l := h.l.With("path", path, "handler", "RepoIndex")
 	ref := chi.URLParam(r, "ref")
+	ref, _ = url.PathUnescape(ref)
 
 	gr, err := git.Open(path, ref)
 	if err != nil {
@@ -148,6 +150,7 @@ func (h *Handle) RepoIndex(w http.ResponseWriter, r *http.Request) {
 func (h *Handle) RepoTree(w http.ResponseWriter, r *http.Request) {
 	treePath := chi.URLParam(r, "*")
 	ref := chi.URLParam(r, "ref")
+	ref, _ = url.PathUnescape(ref)
 
 	l := h.l.With("handler", "RepoTree", "ref", ref, "treePath", treePath)
 
-- 
2.51.2