pki: T9135: correctly resolve a file:// URL when importing a CA certificate

The local-file branch of CA certificate import recognized a file:// URL
by scheme but never actually decoded it - os.path.exists()/open() still
received the full "file://..." string rather than the path component, so
an explicit file:// URL always failed with "File not found" even when it
pointed at a real, readable file.

1 files changed, 10 insertions, 3 deletions

diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py
index 78b896edb..d9f1e8fab 100755
--- a/src/op_mode/pki.py
+++ b/src/op_mode/pki.py
@@ -984,10 +984,17 @@ def import_ca_certificate(
         # get_key(), which this mirrors.
         url = urllib.parse.urlparse(path)
         if url.scheme in ('', 'file'):
-            if not os.path.exists(path):
-                print(f'File not found: {path}')
+            if url.scheme == 'file':
+                if url.netloc:
+                    print(f'Unsupported file URL host: {url.netloc}')
+                    return
+                local_path = urllib.parse.unquote(url.path)
+            else:
+                local_path = path
+            if not os.path.exists(local_path):
+                print(f'File not found: {local_path}')
                 return
-            with open(path) as f:
+            with open(local_path) as f:
                 cert_data = f.read()
         else:
             cert_data = vyos.remote.get_remote_config(path)