Exclude paths act differently between PHP and Rsync file copier

[tedbow]

figure out here https://www.drupal.org/project/automatic_updates/issues/3363937

What our case was

1. we staged an operation
2. We put a file in the active directory
3. we called commit() with an excluded absolute path of the file from 2). The purpose of this is we don't want the file from 2) deleted on commit()

Result
PHP file syncer: this file was not deleted on commit
Rsync file syncer: this file was deleted on commit

We solved this by making the path relative but it seems like they should act the same way.

I chatted with @TravisCarden about this and the absolute path should only be used if it is in the source(stage in this case) directory.

[wimleers]

the absolute path should only be used if it is in the source(stage in this case) directory.

Right. But shouldn't \PhpTuf\ComposerStager\Infrastructure\Value\PathList\PathList::assertValidInput() validate that assumption?

(See my write-up at https://www.drupal.org/project/automatic_updates/issues/3363937#comment-15087236.)

[TravisCarden]

What do you think, @tedbow? Should we add validation to ensure relative paths?