What happened in your environment?

I can still push files with absolute path even if --disable-path-validation is set to false

$ oras push localhost:5000/test:path /my/test/file --disable-path-validation=false
Uploading e3b0c44298fc /my/test/file
Uploaded  e3b0c44298fc /my/test/file
Pushed [registry] localhost:5000/test:path
Digest: sha256:c925e33e51a8ff03e378e2956fdd4aa3a28203ed9aaa778d634c5e647c65bc54

What did you expect to happen?

The operation should fail with warning mentioning that using absolute paths in artifacts is generally insecure and not friendly to cross-platform scenarios.

How can we reproduce it?

Use absolute path to specify files in oras push or oras attach

What is the version of your ORAS CLI?

1.0.0

What is your OS environment?

20.04

Are you willing to submit PRs to fix it?

• Yes, I am willing to fix it.