Skip to content

path/filepath: EvalSymlinks, incorrect traversal of relative paths [1.12 backport] #30586

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
gopherbot opened this issue Mar 5, 2019 · 2 comments
Closed

path/filepath: EvalSymlinks, incorrect traversal of relative paths [1.12 backport] #30586

gopherbot opened this issue Mar 5, 2019 · 2 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Milestone
Go1.12.1

Comments

@gopherbot
Copy link
Contributor

@ianlancetaylor requested issue #30520 to be considered for backport to the next 1.12 minor release.

@gopherbot please open backport to 1.12.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Mar 5, 2019
@gopherbot gopherbot mentioned this issue Mar 5, 2019
Closed
@gopherbot gopherbot added this to the Go1.12.1 milestone Mar 5, 2019
@gopherbot
Copy link
Contributor Author

Change https://golang.org/cl/165197 mentions this issue: [release-branch.go1.12] path/filepath: don't discard .. in EvalSymlinks

@bcmills bcmills added the CherryPickApproved Used during the release process for point releases label Mar 5, 2019
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Mar 5, 2019
@gopherbot
Copy link
Contributor Author

Closed by merging 0ea7460 to release-branch.go1.12.

gopherbot pushed a commit that referenced this issue Mar 5, 2019
@ianlancetaylor
[release-branch.go1.12] path/filepath: don't discard .. in EvalSymlinks
0ea7460 
EvalSymlinks was mishandling cases like "/x/../../y" or "../../../x"
where there is an extra ".." that goes past the start of the path.

Updates #30520
Fixes #30586

Change-Id: I07525575f83009032fa1a99aa270c8d42007d276
Reviewed-on: https://go-review.googlesource.com/c/go/+/164762
Reviewed-by: Bryan C. Mills <[email protected]>
(cherry picked from commit 294edb2)
Reviewed-on: https://go-review.googlesource.com/c/go/+/165197
Reviewed-by: Brad Fitzpatrick <[email protected]>
Run-TryBot: Bryan C. Mills <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
@SwampDragons SwampDragons mentioned this issue Apr 18, 2019
Closed
@golang golang locked and limited conversation to collaborators Mar 4, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Projects
None yet
Milestone
Go1.12.1
Development

No branches or pull requests
2 participants
@bcmills @gopherbot