fix: parse manually and handle url edge cases

Signed-off-by: Kamui <fin-kamui@pm.me>

Author: kamui-fin

tests/test_api.py

@@ -731,6 +731,36 @@ def test_targetfile_hash_prefix_paths(self) -> None:
         )
         self.assertEqual(sorted(target.get_prefixed_paths()), ["public/path/abc.file.ext", "public/path/def.file.ext"])
 
+        target = TargetFile(
+            100, {"sha256": "abc", "md5": "def"}, ""
+        )
+        self.assertEqual(sorted(target.get_prefixed_paths()), [])
+
+        target = TargetFile(
+            100, {"sha256": "abc", "md5": "def"}, "public/path/"
+        )
+        self.assertEqual(sorted(target.get_prefixed_paths()), [])
+
+        target = TargetFile(
+            100, {"sha256": "abc", "md5": "def"}, "file.ext"
+        )
+        self.assertEqual(sorted(target.get_prefixed_paths()), ["abc.file.ext", "def.file.ext"])
+
+        target = TargetFile(
+            100, {"sha256": "abc", "md5": "def"}, "public/path/.ext"
+        )
+        self.assertEqual(sorted(target.get_prefixed_paths()), ["public/path/abc..ext", "public/path/def..ext"])
+
+        target = TargetFile(
+            100, {"sha256": "abc"}, "/root/file.ext"
+        )
+        self.assertEqual(sorted(target.get_prefixed_paths()), ["/root/abc.file.ext"])
+
+        target = TargetFile(
+            100, {"sha256": "abc"}, "/"
+        )
+        self.assertEqual(sorted(target.get_prefixed_paths()), [])
+
     def test_is_delegated_role(self) -> None:
         # test path matches
         # see more extensive tests in test_is_target_in_pathpattern()

tuf/api/metadata.py

@@ -1740,13 +1740,28 @@ def verify_length_and_hashes(self, data: Union[bytes, IO[bytes]]) -> None:
 
     def get_prefixed_paths(self) -> List[str]:
         """
-        Returns hash-prefixed paths for the given target file path.
+        Returns hash-prefixed paths for the given target file path. Empty result in the case of an invalid path.
+
+        Expects self.path to be a URL path fragment, not a filesystem path.
         """
         paths = []
-        path = pathlib.Path(self.path)
-        name, parent = path.name, path.parent
+        try:
+            if not self.path:
+                raise ValueError
+            elif "/" not in self.path:
+                parent, name = None, self.path
+            else:
+                parent, name = self.path.rsplit("/", 1)
+                if name == "": 
+                    raise ValueError
+        except ValueError:
+            return paths
+
         for hash in self.hashes.values():
-            paths.append(str(parent.joinpath(f"{hash}.{name}")))
+            path = f"{hash}.{name}"
+            if parent is not None:
+                path = f"{parent}/{path}"
+            paths.append(path)
         return paths