qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-09-23 09:23:20 -06:00
Code Releases Activity

[release-branch.go1.17] path/filepath: do not remove prefix "." when following path contains ":".

Browse Source 
For #52476
Fixes #52478
Fixes CVE-2022-29804

Change-Id: I9eb72ac7dbccd6322d060291f31831dc389eb9bb
Reviewed-on: https://go-review.googlesource.com/c/go/+/401595
Auto-Submit: Ian Lance Taylor <iant@google.com>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
Run-TryBot: Ian Lance Taylor <iant@google.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-on: https://go-review.googlesource.com/c/go/+/405235
Reviewed-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
This commit is contained in:
Yasuhiro Matsumoto 2022-04-22 10:07:51 +09:00 committed by Dmitri Shuralyov
parent 909881db03
commit 4c69fd51a9
3 changed files with 42 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/path/filepath/path.go
View File

@ -117,9 +117,21 @@ func Clean(path string) string {
case os.IsPathSeparator(path[r]):
// empty path element
r++
case path[r] == '.' && (r+1 == n || os.IsPathSeparator(path[r+1])):
case path[r] == '.' && r+1 == n:
// . element
r++
case path[r] == '.' && os.IsPathSeparator(path[r+1]):
// ./ element
r++
for r < len(path) && os.IsPathSeparator(path[r]) {
r++
}
if out.w == 0 && volumeNameLen(path[r:]) > 0 {
// When joining prefix "." and an absolute path on Windows,
// the prefix should not be removed.
out.append('.')
}
case path[r] == '.' && path[r+1] == '.' && (r+2 == n || os.IsPathSeparator(path[r+2])):
// .. element: remove to last separator
r += 2

3
src/path/filepath/path_test.go
View File

@ -93,6 +93,9 @@ var wincleantests = []PathTest{
{`//host/share/foo/../baz`, `\\host\share\baz`},
{`\\a\b\..\c`, `\\a\b\c`},
{`\\a\b`, `\\a\b`},
{`.\c:`, `.\c:`},
{`.\c:\foo`, `.\c:\foo`},
{`.\c:foo`, `.\c:foo`},
}
func TestClean(t *testing.T) {

26
src/path/filepath/path_windows_test.go
View File

@ -530,3 +530,29 @@ func TestNTNamespaceSymlink(t *testing.T) {
t.Errorf(`EvalSymlinks(%q): got %q, want %q`, filelink, got, want)
}
}
func TestIssue52476(t *testing.T) {
tests := []struct {
lhs, rhs string
want string
}{
{`..\.`, `C:`, `..\C:`},
{`..`, `C:`, `..\C:`},
{`.`, `:`, `:`},
{`.`, `C:`, `.\C:`},
{`.`, `C:/a/b/../c`, `.\C:\a\c`},
{`.`, `\C:`, `.\C:`},
{`C:\`, `.`, `C:\`},
{`C:\`, `C:\`, `C:\C:`},
{`C`, `:`, `C\:`},
{`\.`, `C:`, `\C:`},
{`\`, `C:`, `\C:`},
}
for _, test := range tests {
got := filepath.Join(test.lhs, test.rhs)
if got != test.want {
t.Errorf(`Join(%q, %q): got %q, want %q`, test.lhs, test.rhs, got, test.want)
}
}
}