Bug: Session URL concatenates two url's into one bad one

[jhlmco]

The following section of code incorrectly concatenates the URL into a bad session URL.

Example:

origional session_url: 'https://registry.gitlab.foo.com/v2/project/path/blobs/uploads/3e7bf2a9-xxxx-xxx-xxx-xxxxxxxx?_state=I8fblah'
prefix: 'https://registry.gitlab.foo.com:443'

Result:

session_url: 'https://registry.gitlab.foo.com:443https://registry.gitlab.foo.com/v2/project/path/blobs/uploads/3e7bf2a9-xxxx-xxx-xxx-xxxxxxxx?_state=I8fblah'

Because the registry has the port embedded in the URL the session_url.startswith concatenates it to the good session URL string.

https://github.com/oras-project/oras-py/blob/c817740aefba443817d2b994b243e54e189b8430/oras/provider.py#L496-L499

Expected actions:

Parse off the port from the URL when assigning the prefix to match.

[vsoch]

It looks like GitLab returns a full session url that doesn't start with the prefix (the function assumes it either starts with the prefix or is a partial URL that needs it), so perhaps we should just check if it starts with http. Would you care to submit a PR to adjust this?

[jhlmco]

It looks like GitLab returns a full session url that doesn't start with the prefix (the function assumes it either starts with the prefix or is a partial URL that needs it), so perhaps we should just check if it starts with http. Would you care to submit a PR to adjust this?

@vsoch do you want something to check that it starts with that or do you want to check the protocol + hostname with something like urlparse (urllib)

[vsoch]

I’ll leave to your judgment! The latter sounds more robust but if it’s overkill the simple approach works as well.

[jhlmco]

@vsoch MR for review here: https://github.com/oras-project/oras-py/pull/79

kept it simple