-
- Downloads
os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
Do not permit access to Windows reserved device names (NUL, COM1, etc.) via os.DirFS and http.Dir filesystems. Avoid escapes from os.DirFS(`\`) on Windows. DirFS would join the the root to the relative path with a path separator, making os.DirFS(`\`).Open(`/foo/bar`) open the path `\\foo\bar`, which is a UNC name. Not only does this not open the intended file, but permits reference to any file on the system rather than only files on the current drive. Make os.DirFS("") invalid, with all file access failing. Previously, a root of "" was interpreted as "/", which is surprising and probably unintentional. Fixes CVE-2022-41720 Fixes #56694 Change-Id: I275b5fa391e6ad7404309ea98ccc97405942e0f0 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663834 Reviewed-by:Tatiana Bradley <tatianabradley@google.com> Reviewed-by:
Julie Qiu <julieqiu@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/455362 Reviewed-by:
Michael Pratt <mpratt@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Jenny Rakoczy <jenny@golang.org> Reviewed-on: https://go-review.googlesource.com/c/go/+/455716 Reviewed-by:
Jenny Rakoczy <jenny@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
Showing
- src/go/build/deps_test.go 1 addition, 0 deletionssrc/go/build/deps_test.go
- src/internal/safefilepath/path.go 21 additions, 0 deletionssrc/internal/safefilepath/path.go
- src/internal/safefilepath/path_other.go 23 additions, 0 deletionssrc/internal/safefilepath/path_other.go
- src/internal/safefilepath/path_test.go 88 additions, 0 deletionssrc/internal/safefilepath/path_test.go
- src/internal/safefilepath/path_windows.go 95 additions, 0 deletionssrc/internal/safefilepath/path_windows.go
- src/net/http/fs.go 5 additions, 3 deletionssrc/net/http/fs.go
- src/net/http/fs_test.go 19 additions, 0 deletionssrc/net/http/fs_test.go
- src/os/file.go 26 additions, 18 deletionssrc/os/file.go
- src/os/os_test.go 38 additions, 0 deletionssrc/os/os_test.go
Loading
Please register or sign in to comment