src/path/filepath/path.go | 27 ++++++++++++++------------- src/path/filepath/path_test.go | 7 +++++++ src/path/filepath/path_windows_test.go | 2 +- diff --git a/src/path/filepath/path.go b/src/path/filepath/path.go index de7a2c758b1cf5d8e1c0b66db90b69c4f0492f2c..9b1f5ed7c080238e98a18be9c24f969609731d49 100644 --- a/src/path/filepath/path.go +++ b/src/path/filepath/path.go @@ -15,6 +15,7 @@ import ( "errors" "io/fs" "os" + "runtime" "sort" "strings" ) @@ -117,21 +118,9 @@ switch { case os.IsPathSeparator(path[r]): // empty path element r++ - case path[r] == '.' && r+1 == n: + case path[r] == '.' && (r+1 == n || os.IsPathSeparator(path[r+1])): // . element r++ - case path[r] == '.' && os.IsPathSeparator(path[r+1]): - // ./ element - r++ - - for r < len(path) && os.IsPathSeparator(path[r]) { - r++ - } - if out.w == 0 && volumeNameLen(path[r:]) > 0 { - // When joining prefix "." and an absolute path on Windows, - // the prefix should not be removed. - out.append('.') - } case path[r] == '.' && path[r+1] == '.' && (r+2 == n || os.IsPathSeparator(path[r+2])): // .. element: remove to last separator r += 2 @@ -156,6 +145,18 @@ // real path element. // add slash if needed if rooted && out.w != 1 || !rooted && out.w != 0 { out.append(Separator) + } + // If a ':' appears in the path element at the start of a Windows path, + // insert a .\ at the beginning to avoid converting relative paths + // like a/../c: into c:. + if runtime.GOOS == "windows" && out.w == 0 && out.volLen == 0 && r != 0 { + for i := r; i < n && !os.IsPathSeparator(path[i]); i++ { + if path[i] == ':' { + out.append('.') + out.append(Separator) + break + } + } } // copy element for ; r < n && !os.IsPathSeparator(path[r]); r++ { diff --git a/src/path/filepath/path_test.go b/src/path/filepath/path_test.go index a783d6be2838ab7321941bb71958bbe403b253b0..9a57920dd70a5d9f25da31d63c1e7b3d1f22e79e 100644 --- a/src/path/filepath/path_test.go +++ b/src/path/filepath/path_test.go @@ -96,6 +96,13 @@ {`\\a\b`, `\\a\b`}, {`.\c:`, `.\c:`}, {`.\c:\foo`, `.\c:\foo`}, {`.\c:foo`, `.\c:foo`}, + + // Don't allow cleaning to move an element with a colon to the start of the path. + {`a/../c:`, `.\c:`}, + {`a\..\c:`, `.\c:`}, + {`a/../c:/a`, `.\c:\a`}, + {`a/../../c:`, `..\c:`}, + {`foo:bar`, `foo:bar`}, } func TestClean(t *testing.T) { diff --git a/src/path/filepath/path_windows_test.go b/src/path/filepath/path_windows_test.go index 9e6c0ec81d901c147f549d1f458ac63c0ff13523..857f4d5c7ce863895b770823c5ea2c7472fe3019 100644 --- a/src/path/filepath/path_windows_test.go +++ b/src/path/filepath/path_windows_test.go @@ -542,7 +542,7 @@ want string }{ {`..\.`, `C:`, `..\C:`}, {`..`, `C:`, `..\C:`}, - {`.`, `:`, `:`}, + {`.`, `:`, `.\:`}, {`.`, `C:`, `.\C:`}, {`.`, `C:/a/b/../c`, `.\C:\a\c`}, {`.`, `\C:`, `.\C:`},