Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

path/filepath: Clean(.\c:) returns c: on Windows [1.17 backport] #52478

Closed
gopherbot opened this issue Apr 22, 2022 · 3 comments
Closed

path/filepath: Clean(.\c:) returns c: on Windows [1.17 backport] #52478

gopherbot opened this issue Apr 22, 2022 · 3 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Milestone

Comments

@gopherbot
Copy link

@ianlancetaylor requested issue #52476 to be considered for backport to the next 1.17 minor release.

@gopherbot Please open backport issues.

Avoid confusion with ./C: paths.

@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Apr 22, 2022
@gopherbot gopherbot added this to the Go1.17.10 milestone Apr 22, 2022
@dr2chase dr2chase added the CherryPickApproved Used during the release process for point releases label May 4, 2022
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label May 4, 2022
@gopherbot
Copy link
Author

Change https://go.dev/cl/405235 mentions this issue: [release-branch.go1.17] path/filepath: do not remove prefix "." when following path contains ":"

@heschi
Copy link
Contributor

heschi commented May 13, 2022

cc @golang/security to review the fix

@gopherbot
Copy link
Author

Closed by merging 4c69fd5 to release-branch.go1.17.

gopherbot pushed a commit that referenced this issue May 31, 2022
…following path contains ":".

For #52476
Fixes #52478
Fixes CVE-2022-29804

Change-Id: I9eb72ac7dbccd6322d060291f31831dc389eb9bb
Reviewed-on: https://go-review.googlesource.com/c/go/+/401595
Auto-Submit: Ian Lance Taylor <iant@google.com>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
Run-TryBot: Ian Lance Taylor <iant@google.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-on: https://go-review.googlesource.com/c/go/+/405235
Reviewed-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
@golang golang locked and limited conversation to collaborators May 31, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Projects
None yet
Development

No branches or pull requests

4 participants