improve path handling for cross platform

Author: koba1t

api/internal/loader/fileloader.go

@@ -211,8 +211,9 @@ func newLoaderAtGitClone(
 	// check for this after cloning repo.
 	if !root.HasPrefix(repoSpec.CloneDir()) {
 		_ = cleaner()
-		return nil, fmt.Errorf("%q refers to directory outside of repo %q", repoSpec.AbsPath(),
-			repoSpec.CloneDir())
+		return nil, fmt.Errorf("%q refers to directory outside of repo %q",
+			filepath.ToSlash(repoSpec.AbsPath()),
+			filepath.ToSlash(repoSpec.CloneDir().String()))
 	}
 	return &FileLoader{
 		// Clones never allowed to escape root.

api/internal/loader/fileloader_test.go

@@ -208,7 +208,7 @@ func TestLoaderLocalScheme(t *testing.T) {
 	t.Run("file", func(t *testing.T) {
 		fSys, dir := setupOnDisk(t)
 		parts := []string{
-			"ssh:",
+			"ssh-scheme",
 			"resource.yaml",
 		}
 		require.NoError(t, fSys.Mkdir(dir.Join(parts[0])))
@@ -226,8 +226,9 @@ func TestLoaderLocalScheme(t *testing.T) {
 	})
 	t.Run("directory", func(t *testing.T) {
 		fSys, dir := setupOnDisk(t)
+		// Use scheme-like name without colon for Windows compatibility
 		parts := []string{
-			"https:",
+			"https-scheme",
 			"root",
 		}
 		require.NoError(t, fSys.MkdirAll(dir.Join(filepath.Join(parts...))))
@@ -379,6 +380,7 @@ func TestNewLoaderAtGitClone(t *testing.T) {
 	rootURL := "github.com/someOrg/someRepo"
 	pathInRepo := "foo/base"
 	url := rootURL + "/" + pathInRepo
+	// Use absolute path starting with / for in-memory filesystem
 	coRoot := "/tmp"
 	fSys := filesys.MakeFsInMemory()
 	fSys.MkdirAll(coRoot)
@@ -422,6 +424,7 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
 	require := require.New(t)
 
 	// Define an overlay-base structure in the file system.
+	// Use absolute paths for in-memory filesystem
 	topDir := "/whatever"
 	cloneRoot := topDir + "/someClone"
 	fSys := filesys.MakeFsInMemory()
@@ -494,12 +497,14 @@ func TestLoaderDisallowsRemoteBaseExitRepo(t *testing.T) {
 
 	_, err = newLoaderAtGitClone(repoSpec, fSys, nil, git.DoNothingCloner(filesys.ConfirmedDir(repo)))
 	require.Error(t, err)
-	require.Contains(t, err.Error(), fmt.Sprintf("%q refers to directory outside of repo %q", base, repo))
+	// Use filepath.ToSlash to normalize paths for cross-platform comparison
+	require.Contains(t, err.Error(), fmt.Sprintf("%q refers to directory outside of repo %q", filepath.ToSlash(base), filepath.ToSlash(repo)))
 }
 
 func TestLocalLoaderReferencingGitBase(t *testing.T) {
 	require := require.New(t)
 
+	// Use absolute paths for in-memory filesystem
 	topDir := "/whatever"
 	cloneRoot := topDir + "/someClone"
 	fSys := filesys.MakeFsInMemory()
@@ -521,6 +526,7 @@ func TestLocalLoaderReferencingGitBase(t *testing.T) {
 func TestRepoDirectCycleDetection(t *testing.T) {
 	require := require.New(t)
 
+	// Use absolute paths for in-memory filesystem
 	topDir := "/cycles"
 	cloneRoot := topDir + "/someClone"
 	fSys := filesys.MakeFsInMemory()
@@ -543,6 +549,7 @@ func TestRepoDirectCycleDetection(t *testing.T) {
 func TestRepoIndirectCycleDetection(t *testing.T) {
 	require := require.New(t)
 
+	// Use absolute paths for in-memory filesystem
 	topDir := "/cycles"
 	cloneRoot := topDir + "/someClone"
 	fSys := filesys.MakeFsInMemory()

api/internal/loader/loadrestrictions.go

@@ -5,6 +5,7 @@ package loader
 
 import (
 	"fmt"
+	"path/filepath"
 
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
@@ -24,7 +25,7 @@ func RestrictionRootOnly(
 	if !d.HasPrefix(root) {
 		return "", fmt.Errorf(
 			"security; file '%s' is not in or below '%s'",
-			path, root)
+			filepath.ToSlash(path), filepath.ToSlash(root.String()))
 	}
 	return d.Join(f), nil
 }

api/internal/loader/loadrestrictions_test.go

@@ -4,6 +4,7 @@
 package loader
 
 import (
+	"fmt"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -59,9 +60,11 @@ func TestRestrictionRootOnly(t *testing.T) {
 	if err == nil {
 		t.Fatal("should have an error")
 	}
-	if !strings.Contains(
-		err.Error(),
-		"file '/tmp/illegal' is not in or below '/tmp/foo'") {
+	// Normalize paths to forward slashes for cross-platform comparison
+	expectedErr := fmt.Sprintf("file '%s' is not in or below '%s'",
+		filepath.ToSlash(filepath.Join(filesys.Separator+"tmp", "illegal")),
+		filepath.ToSlash(filepath.Join(filesys.Separator+"tmp", "foo")))
+	if !strings.Contains(err.Error(), expectedErr) {
 		t.Fatalf("unexpected err: %s", err)
 	}
 }

api/internal/localizer/util.go

@@ -152,7 +152,11 @@ func locFilePath(fileURL string) string {
 	// Raw github urls are the only type of file urls kustomize officially accepts.
 	// In this case, the path already consists of org, repo, version, and path in repo, in order,
 	// so we can use it as is.
-	return filepath.Join(LocalizeDir, u.Hostname(), path)
+	hostname := u.Hostname()
+	// On Windows, colons are invalid in file paths. Replace them with hyphens
+	// to make IPv6 addresses filesystem-safe.
+	hostname = strings.ReplaceAll(hostname, ":", "-")
+	return filepath.Join(LocalizeDir, hostname, path)
 }
 
 // locRootPath returns the relative localized path of the validated root url rootURL, where the local copy of its repo

api/internal/localizer/util_test.go

@@ -14,6 +14,7 @@ import (
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/git"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
+	"sigs.k8s.io/kustomize/kyaml/testutil"
 )
 
 func TestDefaultNewDirRepo(t *testing.T) {
@@ -120,7 +121,8 @@ func TestLocFilePathColon(t *testing.T) {
 
 	// The colon is special because it was once used as the unix file separator.
 	const url = "https://[2001:4860:4860::8888]/file.yaml"
-	const host = "2001:4860:4860::8888"
+	// On Windows, colons are replaced with hyphens in IPv6 addresses
+	const host = "2001-4860-4860--8888"
 	const file = "file.yaml"
 	req.Equal(simpleJoin(t, LocalizeDir, host, file), locFilePath(url))
 
@@ -129,8 +131,10 @@ func TestLocFilePathColon(t *testing.T) {
 
 	// We check that we can create single directory, meaning ':' not used as file separator.
 	req.NoError(fSys.Mkdir(targetDir))
-	_, err := fSys.Create(simpleJoin(t, targetDir, file))
+	f, err := fSys.Create(simpleJoin(t, targetDir, file))
 	req.NoError(err)
+	// Close the file immediately to avoid file locking issues on Windows
+	req.NoError(f.Close())
 
 	// We check that the directory with such name is readable.
 	files, err := fSys.ReadDir(targetDir)
@@ -139,6 +143,9 @@ func TestLocFilePathColon(t *testing.T) {
 }
 
 func TestLocFilePath_SpecialChar(t *testing.T) {
+	// Skip on Windows as asterisk is invalid in Windows paths
+	testutil.SkipWindows(t)
+
 	req := require.New(t)
 
 	// The wild card character is one of the legal uri characters with more meaning
@@ -163,19 +170,26 @@ func TestLocFilePath_SpecialFiles(t *testing.T) {
 	for name, tFSys := range map[string]struct {
 		urlPath           string
 		pathDir, pathFile string
+		skipWindows       bool // Skip this test case on Windows
 	}{
 		"windows_reserved_name": {
 			urlPath:  "/aux/file",
 			pathDir:  "aux",
 			pathFile: "file",
 		},
 		"hidden_files": {
-			urlPath:  "/.../.file",
-			pathDir:  "...",
-			pathFile: ".file",
+			urlPath:     "/.../.file",
+			pathDir:     "...",
+			pathFile:    ".file",
+			skipWindows: true, // Windows treats "..." specially
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
+			// Skip Windows-incompatible tests
+			if tFSys.skipWindows {
+				testutil.SkipWindows(t)
+			}
+
 			req := require.New(t)
 
 			expectedPath := simpleJoin(t, LocalizeDir, "host", tFSys.pathDir, tFSys.pathFile)
@@ -304,23 +318,41 @@ func TestLocRootPath_SymlinkPath(t *testing.T) {
 
 func TestCleanedRelativePath(t *testing.T) {
 	fSys := filesys.MakeFsInMemory()
-	require.NoError(t, fSys.MkdirAll("/root/test"))
-	require.NoError(t, fSys.WriteFile("/root/test/file.yaml", []byte("")))
-	require.NoError(t, fSys.WriteFile("/root/filetwo.yaml", []byte("")))
+	// Use platform-appropriate root path
+	rootPath := string(filepath.Separator) + "root"
+	testPath := filepath.Join(rootPath, "test")
+
+	require.NoError(t, fSys.MkdirAll(testPath))
+	require.NoError(t, fSys.WriteFile(filepath.Join(testPath, "file.yaml"), []byte("")))
+	require.NoError(t, fSys.WriteFile(filepath.Join(rootPath, "filetwo.yaml"), []byte("")))
 
 	// Absolute path is cleaned to relative path
-	cleanedPath := cleanedRelativePath(fSys, "/root/", "/root/test/file.yaml")
-	require.Equal(t, "test/file.yaml", cleanedPath)
+	cleanedPath := cleanedRelativePath(
+		fSys,
+		filesys.ConfirmedDir(rootPath+string(filepath.Separator)),
+		filepath.Join(testPath, "file.yaml"))
+	require.Equal(t, filepath.Join("test", "file.yaml"), cleanedPath)
 
 	// Winding absolute path is cleaned to relative path
-	cleanedPath = cleanedRelativePath(fSys, "/root/", "/root/test/../filetwo.yaml")
+	windingPath := filepath.Join(rootPath, "test", "..", "filetwo.yaml")
+	cleanedPath = cleanedRelativePath(
+		fSys,
+		filesys.ConfirmedDir(rootPath+string(filepath.Separator)),
+		windingPath)
 	require.Equal(t, "filetwo.yaml", cleanedPath)
 
 	// Already clean relative path stays the same
-	cleanedPath = cleanedRelativePath(fSys, "/root/", "test/file.yaml")
-	require.Equal(t, "test/file.yaml", cleanedPath)
+	cleanedPath = cleanedRelativePath(
+		fSys,
+		filesys.ConfirmedDir(rootPath+string(filepath.Separator)),
+		filepath.Join("test", "file.yaml"))
+	require.Equal(t, filepath.Join("test", "file.yaml"), cleanedPath)
 
 	// Winding relative path is cleaned
-	cleanedPath = cleanedRelativePath(fSys, "/root/", "test/../filetwo.yaml")
+	windingRelPath := filepath.Join("test", "..", "filetwo.yaml")
+	cleanedPath = cleanedRelativePath(
+		fSys,
+		filesys.ConfirmedDir(rootPath+string(filepath.Separator)),
+		windingRelPath)
 	require.Equal(t, "filetwo.yaml", cleanedPath)
 }

api/internal/target/kusttarget_test.go

@@ -122,11 +122,13 @@ commonLabels:
 		},
 	}
 
+	// Use platform-appropriate root directory
+	rootDir := string(filepath.Separator)
 	kt := makeKustTargetWithRf(
-		t, th.GetFSys(), "/", provider.NewDefaultDepProvider())
+		t, th.GetFSys(), rootDir, provider.NewDefaultDepProvider())
 	for tn, tc := range testCases {
 		t.Run(tn, func(t *testing.T) {
-			th.WriteK("/", tc.content)
+			th.WriteK(rootDir, tc.content)
 			err := kt.Load()
 			if tc.errContains != "" {
 				require.NotNilf(t, err, "expected error containing: `%s`", tc.errContains)

api/krusty/fnplugin_test.go

@@ -25,32 +25,6 @@ const (
 	repoRootDir = "../../"
 )
 
-const generateDeploymentDotSh = `#!/bin/sh
-
-cat <<EOF
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nginx
-  labels:
-    app: nginx
-  annotations:
-    tshirt-size: small # this injects the resource reservations
-spec:
-  selector:
-    matchLabels:
-      app: nginx
-  template:
-    metadata:
-      labels:
-        app: nginx
-    spec:
-      containers:
-      - name: nginx
-        image: nginx
-EOF
-`
-
 const krmTransformerDotSh = `#!/bin/bash
 cat << EOF
 apiVersion: v1

api/krusty/originannotation_test.go

@@ -16,6 +16,32 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
+const generateDeploymentDotSh = `#!/bin/sh
+
+cat <<EOF
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+  annotations:
+    tshirt-size: small # this injects the resource reservations
+spec:
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx
+EOF
+`
+
 func TestAnnoOriginLocalFiles(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	th.WriteF("service.yaml", `

api/resource/origin.go

@@ -54,6 +54,8 @@ func (origin *Origin) Append(inputPath string) *Origin {
 	if err == nil {
 		originCopy.Repo = repoSpec.CloneSpec()
 		absPath := repoSpec.AbsPath()
+		// Normalize to forward slashes for cross-platform compatibility
+		absPath = strings.ReplaceAll(absPath, "\\", "/")
 		inputPath = absPath[strings.Index(absPath[1:], "/")+1:][1:]
 		originCopy.Path = ""
 		originCopy.Ref = repoSpec.Ref