knotserver: allow downloading archives of refs with slashes in their names

This allows us to be more precise when downloading e.g. tags that have the
same name as branches (in which case Git defaults to the branch, not sure
what go-git does).

Signed-off-by: Winter <[e-mail]>

knotserver/routes.go

···
 
 	ref := strings.TrimSuffix(file, ".tar.gz")
 
+	unescapedRef, err := url.PathUnescape(ref)
+	if err != nil {
+		notFound(w)
+		return
+	}
+
+	// refs/tags/* is way more common than refs/heads/*, so we can live with an ugly file/directory
+	// name in the odd cases (e.g. refs-heads-master.tar.gz, but in that case the user should just
+	// request master.tar.gz)
+	safeRefFilename := strings.ReplaceAll(strings.TrimPrefix(unescapedRef, "refs/tags/"), "/", "-")
+
 	// This allows the browser to use a proper name for the file when
 	// downloading
-	filename := fmt.Sprintf("%s-%s.tar.gz", name, ref)
+	filename := fmt.Sprintf("%s-%s.tar.gz", name, safeRefFilename)
 	setContentDisposition(w, filename)
 	setGZipMIME(w)
 
 	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
-	gr, err := git.Open(path, ref)
+	gr, err := git.Open(path, unescapedRef)
 	if err != nil {
 		notFound(w)
 		return
···
 	gw := gzip.NewWriter(w)
 	defer gw.Close()
 
-	prefix := fmt.Sprintf("%s-%s", name, ref)
+	prefix := fmt.Sprintf("%s-%s", name, safeRefFilename)
 	err = gr.WriteTar(gw, prefix)
 	if err != nil {
 		// once we start writing to the body we can't report error anymore