fix: ERR_PNPM_TARBALL_EXTRACT when the URL's hash contains a slash (#8761)

close #7697

.changeset/serious-yaks-dance.md

@@ -0,0 +1,6 @@
+---
+"@pnpm/tarball-resolver": patch
+"pnpm": patch
+---
+
+Fix `ERR_PNPM_TARBALL_EXTRACT` error while installing a dependency from GitHub having a slash in branch name [#7697](https://github.com/pnpm/pnpm/issues/7697).

pnpm/test/install/misc.ts

@@ -562,3 +562,15 @@ test('do not hang on circular peer dependencies', () => {
   expect(result.status).toBe(0)
   expect(fs.existsSync(path.join(tempDir, WANTED_LOCKFILE))).toBeTruthy()
 })
+
+// Covers https://github.com/pnpm/pnpm/issues/7697
+test('install success even though the url\'s hash contains slash', async () => {
+  prepare()
+  const settings = ['--fetch-retries=0']
+  const result = execPnpmSync([
+    'add',
+    'https://github.com/pnpm-e2e/simple-pkg.git#branch/with-slash',
+    ...settings,
+  ])
+  expect(result.status).toBe(0)
+})

resolving/tarball-resolver/src/index.ts

@@ -26,6 +26,11 @@ const GIT_HOSTERS = new Set([
 ])
 
 function isRepository (pref: string): boolean {
+  const url = new URL(pref)
+  if (url.hash && url.hash.includes('/')) {
+    url.hash = encodeURIComponent(url.hash.substring(1))
+    pref = url.href
+  }
   if (pref.endsWith('/')) {
     pref = pref.slice(0, -1)
   }

resolving/tarball-resolver/test/index.ts

@@ -60,3 +60,13 @@ test('ignore direct URLs to repositories', async () => {
   expect(await resolveFromTarball({ pref: 'https://gitlab.com/foo/bar' })).toBe(null)
   expect(await resolveFromTarball({ pref: 'https://bitbucket.org/foo/bar' })).toBe(null)
 })
+
+test('ignore slash in hash', async () => {
+  // expect resolve from git.
+  let hash = 'path:/packages/simple-react-app'
+  expect(await resolveFromTarball({ pref: `RexSkz/test-git-subdir-fetch#${hash}` })).toBe(null)
+  expect(await resolveFromTarball({ pref: `RexSkz/test-git-subdir-fetch#${encodeURIComponent(hash)}` })).toBe(null)
+  hash = 'heads/canary'
+  expect(await resolveFromTarball({ pref: `zkochan/is-negative#${hash}` })).toBe(null)
+  expect(await resolveFromTarball({ pref: `zkochan/is-negative#${encodeURIComponent(hash)}` })).toBe(null)
+})