src/path/filepath/path.go | 27 ++++++++++++++------------- src/path/filepath/path_test.go | 8 ++++++++ src/path/filepath/path_windows_test.go | 2 +- diff --git a/src/path/filepath/path.go b/src/path/filepath/path.go index a6578cbb728b95462b50da148a2342ba74e9faf7..32dd887998650bff7cff4456c1ea1e023fcaa522 100644 --- a/src/path/filepath/path.go +++ b/src/path/filepath/path.go @@ -15,6 +15,7 @@ import ( "errors" "io/fs" "os" + "runtime" "sort" "strings" ) @@ -117,21 +118,9 @@ switch { case os.IsPathSeparator(path[r]): // empty path element r++ - case path[r] == '.' && r+1 == n: + case path[r] == '.' && (r+1 == n || os.IsPathSeparator(path[r+1])): // . element r++ - case path[r] == '.' && os.IsPathSeparator(path[r+1]): - // ./ element - r++ - - for r < len(path) && os.IsPathSeparator(path[r]) { - r++ - } - if out.w == 0 && volumeNameLen(path[r:]) > 0 { - // When joining prefix "." and an absolute path on Windows, - // the prefix should not be removed. - out.append('.') - } case path[r] == '.' && path[r+1] == '.' && (r+2 == n || os.IsPathSeparator(path[r+2])): // .. element: remove to last separator r += 2 @@ -156,6 +145,18 @@ // real path element. // add slash if needed if rooted && out.w != 1 || !rooted && out.w != 0 { out.append(Separator) + } + // If a ':' appears in the path element at the start of a Windows path, + // insert a .\ at the beginning to avoid converting relative paths + // like a/../c: into c:. + if runtime.GOOS == "windows" && out.w == 0 && out.volLen == 0 && r != 0 { + for i := r; i < n && !os.IsPathSeparator(path[i]); i++ { + if path[i] == ':' { + out.append('.') + out.append(Separator) + break + } + } } // copy element for ; r < n && !os.IsPathSeparator(path[r]); r++ { diff --git a/src/path/filepath/path_test.go b/src/path/filepath/path_test.go index 66474448526675cea863ddbadae5fd2fb693934d..697bcc672d73c300482e335eeee3523cd82721a8 100644 --- a/src/path/filepath/path_test.go +++ b/src/path/filepath/path_test.go @@ -106,6 +106,13 @@ {`.\c:foo`, `.\c:foo`}, {`//abc`, `\\abc`}, {`///abc`, `\\\abc`}, {`//abc//`, `\\abc\\`}, + + // Don't allow cleaning to move an element with a colon to the start of the path. + {`a/../c:`, `.\c:`}, + {`a\..\c:`, `.\c:`}, + {`a/../c:/a`, `.\c:\a`}, + {`a/../../c:`, `..\c:`}, + {`foo:bar`, `foo:bar`}, } func TestClean(t *testing.T) { @@ -174,6 +181,7 @@ {`\a`, false}, {`C:`, false}, {`C:\a`, false}, {`..\a`, false}, + {`a/../c:`, false}, {`CONIN$`, false}, {`conin$`, false}, {`CONOUT$`, false}, diff --git a/src/path/filepath/path_windows_test.go b/src/path/filepath/path_windows_test.go index e37dddceadbdf1510ee0df7eaf7dba9fc04358b0..c8c7eefcc0bb4bd2ff193001cded0b7892893e54 100644 --- a/src/path/filepath/path_windows_test.go +++ b/src/path/filepath/path_windows_test.go @@ -542,7 +542,7 @@ want string }{ {`..\.`, `C:`, `..\C:`}, {`..`, `C:`, `..\C:`}, - {`.`, `:`, `:`}, + {`.`, `:`, `.\:`}, {`.`, `C:`, `.\C:`}, {`.`, `C:/a/b/../c`, `.\C:\a\c`}, {`.`, `\C:`, `.\C:`},