bamaer commented on PR #8306:
URL: https://github.com/apache/hop/pull/8306#issuecomment-5652097265
Built the branch this time. 1, 2 and 4 are genuinely fixed — confirmed
`report:2026-09-11.html` serves 200 end-to-end, and `sessionMismatchIsNotFound`
still passes alongside the new rotation test, so the session binding didn't go
vacuous.
3 shifted rather than closed. The consuming half is right, but
`relativePath()` still feeds `sanitizeRelativePath` the output of
`getRelativeName()`, which leaves `%` URI-escaped — so it violates the "already
decoded" contract the commit just documented. `100% done.html` becomes
`100%2525%20done.html`, the container decodes once, `.replace("%", "%25")`
escapes it again, and VFS looks for a file that doesn't exist. Still 404, same
for `a%20b.html`. The new tests miss it because they start from a hand-written
decoded path instead of going through `relativePath()`.
```java
// getRelativeName() keeps '%' URI-escaped; sanitizeRelativePath() expects
decoded input.
return
sanitizeRelativePath(UriParser.decode(root.getName().getRelativeName(file.getName())));
```
With that, both names serve 200 and the existing 26 explorer tests still
pass. A test starting from a real `FileObject` would keep it covered.
Minor, non-blocking: is `js`/`mjs` in `ALLOWED_EXTENSIONS` needed or
speculative?
Happy to approve once 3 is in.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
