Bug: Session URL concatenates two url's into one bad one

[jhlmco]

The following section of code incorrectly concatenates the URL into a bad session URL.

Example:

origional session_url: 'https://registry.gitlab.foo.com/v2/project/path/blobs/uploads/3e7bf2a9-xxxx-xxx-xxx-xxxxxxxx?_state=I8fblah'
prefix: 'https://registry.gitlab.foo.com:443'

Result:

session_url: 'https://registry.gitlab.foo.com:443https://registry.gitlab.foo.com/v2/project/path/blobs/uploads/3e7bf2a9-xxxx-xxx-xxx-xxxxxxxx?_state=I8fblah'

Because the registry has the port embedded in the URL the session_url.startswith concatenates it to the good session URL string.

oras-py/oras/provider.py

Lines 496 to 499 in c817740

	prefix = f"{self.prefix}://{container.registry}"
	if not session_url.startswith(prefix):
	session_url = f"{prefix}{session_url}"
	return session_url

Expected actions:

Parse off the port from the URL when assigning the prefix to match.

[vsoch]

It looks like GitLab returns a full session url that doesn't start with the prefix (the function assumes it either starts with the prefix or is a partial URL that needs it), so perhaps we should just check if it starts with http. Would you care to submit a PR to adjust this?

[jhlmco]

It looks like GitLab returns a full session url that doesn't start with the prefix (the function assumes it either starts with the prefix or is a partial URL that needs it), so perhaps we should just check if it starts with http. Would you care to submit a PR to adjust this?

@vsoch do you want something to check that it starts with that or do you want to check the protocol + hostname with something like urlparse (urllib)

[vsoch]

I’ll leave to your judgment! The latter sounds more robust but if it’s overkill the simple approach works as well.

[jhlmco]

@vsoch MR for review here: #79

kept it simple