Skip to content
Snippets Groups Projects
Commit 7dc9fcb1 authored by Damien Neil's avatar Damien Neil
Browse files

os, net/http: avoid escapes from os.DirFS and http.Dir on Windows

Do not permit access to Windows reserved device names (NUL, COM1, etc.)
via os.DirFS and http.Dir filesystems.

Avoid escapes from os.DirFS(`\`) on Windows. DirFS would join the
the root to the relative path with a path separator, making
os.DirFS(`\`).Open(`/foo/bar`) open the path `\\foo\bar`, which is
a UNC name. Not only does this not open the intended file, but permits
reference to any file on the system rather than only files on the
current drive.

Make os.DirFS("") invalid, with all file access failing. Previously,
a root of "" was interpreted as "/", which is surprising and probably
unintentional.

Fixes CVE-2022-41720
Fixes #56694

Change-Id: I275b5fa391e6ad7404309ea98ccc97405942e0f0
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663834


Reviewed-by: default avatarTatiana Bradley <tatianabradley@google.com>
Reviewed-by: default avatarJulie Qiu <julieqiu@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/455362


Reviewed-by: default avatarMichael Pratt <mpratt@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Jenny Rakoczy <jenny@golang.org>
Reviewed-on: https://go-review.googlesource.com/c/go/+/455716


Reviewed-by: default avatarJenny Rakoczy <jenny@golang.org>
Run-TryBot: Damien Neil <dneil@google.com>
parent e535d677
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment