Code review.

lib/src/source/git.dart

@@ -68,6 +68,10 @@ class GitSource extends Source {
       } else if (!p.url.isRelative(path)) {
         throw new FormatException(
             "The 'path' field of the description must be relative.");
+      } else if (!p.url.isWithin('.', path)) {
+        throw new FormatException(
+            "The 'path' field of the description must not reach outside the "
+            "repository.");
       }
 
       _validateUrl(path);
@@ -430,14 +434,14 @@ class BoundGitSource extends CachedSource {
   List<String> _readPackageList(String revisionCachePath) {
     var path = _packageListPath(revisionCachePath);
 
-    // If there's no pubspec list file, this cache was created by an older
+    // If there's no package list file, this cache was created by an older
     // version of pub where pubspecs were only allowed at the root of the
     // repository.
-    if (!fileExists(path)) return ['./pubspec.yaml'];
+    if (!fileExists(path)) return ['.'];
     return readTextFile(path).split("\n");
   }
 
-  /// Writes a package list indicating that we care about [packages] exist in
+  /// Writes a package list indicating that [packages] exist in
   /// [revisionCachePath].
   void _writePackageList(String revisionCachePath, List<String> packages) {
     writeTextFile(_packageListPath(revisionCachePath), packages.join('\n'));
@@ -503,7 +507,9 @@ class BoundGitSource extends CachedSource {
   /// This name is not guaranteed to be unique.
   String _repoName(PackageName packageName) {
     var name = p.url.basename(packageName.description['url']);
-    if (name.endsWith('.git')) name = name.substring(0, name.length - 4);
+    if (name.endsWith('.git')) {
+      name = name.substring(0, name.length - '.git'.length);
+    }
     return name;
   }
 }

test/cache/repair/git_test.dart

@@ -147,7 +147,7 @@ main() {
           .where((dir) => path.basename(dir).startsWith("foo-"))
           .toList();
 
-      // Delete "foo.dart" from them.
+      // Delete "sub.dart" from them.
       for (var dir in fooDirs) {
         deleteEntry(path.join(dir, "subdir/lib/sub.dart"));
       }

test/get/git/path_test.dart

@@ -41,6 +41,37 @@ main() {
     }).validate();
   });
 
+  test('depends on a package in a deep subdirectory', () async {
+    ensureGit();
+
+    var repo = d.git('foo.git', [
+      d.dir('sub', [d.dir('dir', [d.libPubspec('sub', '1.0.0'), d.libDir('sub', '1.0.0')])])
+    ]);
+    await repo.create();
+
+    await d.appDir({
+      "sub": {
+        "git": {"url": "../foo.git", "path": "sub/dir"}
+      }
+    }).create();
+
+    await pubGet();
+
+    await d.dir(cachePath, [
+      d.dir('git', [
+        d.dir('cache', [d.gitPackageRepoCacheDir('foo')]),
+        d.hashDir('foo', [
+          d.dir('sub', [
+          d.dir('dir', [d.libDir('sub', '1.0.0')])])
+        ])
+      ])
+    ]).validate();
+
+    await d.appPackagesFile({
+      'sub': pathInCache('git/foo-${await repo.revParse('HEAD')}/sub/dir')
+    }).validate();
+  });
+
   test('depends on multiple packages in subdirectories', () async {
     ensureGit();
 

test/pubspec_test.dart

@@ -457,6 +457,46 @@ dependencies:
           'pubspec.');
     });
 
+    group("git dependencies", () {
+      test("path must be a string", () {
+        expectPubspecException('''
+dependencies:
+  foo:
+    git:
+      url: git://github.com/dart-lang/foo
+      path: 12
+''', (pubspec) => pubspec.dependencies);
+      });
+
+      test("path must be relative", () {
+        expectPubspecException('''
+dependencies:
+  foo:
+    git:
+      url: git://github.com/dart-lang/foo
+      path: git://github.com/dart-lang/foo/bar
+''', (pubspec) => pubspec.dependencies);
+
+        expectPubspecException('''
+dependencies:
+  foo:
+    git:
+      url: git://github.com/dart-lang/foo
+      path: /foo
+''', (pubspec) => pubspec.dependencies);
+      });
+
+      test("path must be within the repository", () {
+        expectPubspecException('''
+dependencies:
+  foo:
+    git:
+      url: git://github.com/dart-lang/foo
+      path: foo/../../bar
+''', (pubspec) => pubspec.dependencies);
+      });
+    });
+
     group("environment", () {
       test("allows an omitted environment", () {
         var pubspec = new Pubspec.parse('', sources);