net/url: JoinPath doesn't strip relative path components in all circumstances #54385

neild · 2022-08-11T01:01:24Z

fmt.Println(url.JoinPath("https://go.dev", "../x"))  // https://go.dev/../x
fmt.Println(url.JoinPath("https://go.dev/", "../x")) // https://go.dev/x

https://go.dev/play/p/gLLv0cc_jn1

JoinPath doesn't remove ../ path components appended to a domain that is not terminated by a slash. This is surprising and could conceivably lead to a directory traversal attack. The result of JoinPath shouldn't depend on whether the first component is / terminated or not.

Thanks to @q0jt for reporting this bug.

The text was updated successfully, but these errors were encountered:

neild · 2022-08-11T01:30:37Z

This is CVE-2022-32190.

q0jt · 2022-08-11T14:21:31Z

Relative paths are now removed from elements with this patch #54390.

// OK
fmt.Println(url.JoinPath("https://go.dev", "../x")) // https://go.dev/x
fmt.Println(url.JoinPath("https://go.dev", "./x")) // https://go.dev/x

If a path contains whitespace or an invalid string at the beginning, it can be bypassed as follows.

- url.JoinPath("https://go.dev", "./../../x") // https://go.dev/../../x
- url.JoinPath("https://go.dev", "..;/../../../../../x") // https://go.dev/../../../../x
- url.JoinPath("https://go.dev", " ../../../../../../x") // https://go.dev/../../../../x

// OK
-  url.JoinPath("https://go.dev", "../.././x") // https://go.dev/x

cc @neild @cuishuang

gopherbot · 2022-08-12T23:27:34Z

Change https://go.dev/cl/423514 mentions this issue: net/url: consistently remove ../ elements in JoinPath

gopherbot · 2022-08-13T13:21:11Z

Change https://go.dev/cl/422715 mentions this issue: net/url: strip relative path components for JoinPath

cuishuang · 2022-08-16T12:34:27Z

Relative paths are now removed from elements with this patch #54390.

// OK
fmt.Println(url.JoinPath("https://go.dev", "../x")) // https://go.dev/x
fmt.Println(url.JoinPath("https://go.dev", "./x")) // https://go.dev/x

If a path contains whitespace or an invalid string at the beginning, it can be bypassed as follows.

- url.JoinPath("https://go.dev", "./../../x") // https://go.dev/../../x
- url.JoinPath("https://go.dev", "..;/../../../../../x") // https://go.dev/../../../../x
- url.JoinPath("https://go.dev", " ../../../../../../x") // https://go.dev/../../../../x

// OK
-  url.JoinPath("https://go.dev", "../.././x") // https://go.dev/x

cc @neild @cuishuang

Relative paths are now removed from elements with this patch #54390.

// OK
fmt.Println(url.JoinPath("https://go.dev", "../x")) // https://go.dev/x
fmt.Println(url.JoinPath("https://go.dev", "./x")) // https://go.dev/x

If a path contains whitespace or an invalid string at the beginning, it can be bypassed as follows.

- url.JoinPath("https://go.dev", "./../../x") // https://go.dev/../../x
- url.JoinPath("https://go.dev", "..;/../../../../../x") // https://go.dev/../../../../x
- url.JoinPath("https://go.dev", " ../../../../../../x") // https://go.dev/../../../../x

// OK
-  url.JoinPath("https://go.dev", "../.././x") // https://go.dev/x

cc @neild @cuishuang

Maybe refer to this pr https://go-review.googlesource.com/c/go/+/423514/

q0jt · 2022-08-16T15:02:53Z

Maybe refer to this pr https://go-review.googlesource.com/c/go/+/423514/

PR https://go-review.googlesource.com/c/go/+/423514/ has resolved this issue.
This fix is working properly, and therefore I mark this ticket as resolved.

Many thanks.

neild · 2022-08-23T22:01:22Z

@gopherbot please open backport issues.

gopherbot · 2022-08-23T22:02:00Z

Backport issue(s) opened: #54634 (for 1.18), #54635 (for 1.19).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

gopherbot · 2022-08-24T18:19:19Z

Change https://go.dev/cl/425357 mentions this issue: [release-branch.go1.19] net/url: consistently remove ../ elements in JoinPath

…JoinPath JoinPath would fail to remove relative elements from the start of the path when the first path element is "". In addition, JoinPath would return the original path unmodified when provided with no elements to join, violating the documented behavior of always cleaning the resulting path. Correct both these cases. JoinPath("http://go.dev", "../go") // before: http://go.dev/../go // after: http://go.dev/go JoinPath("http://go.dev/../go") // before: http://go.dev/../go // after: http://go.dev/go For #54385. Fixes #54635. Fixes CVE-2022-32190. Change-Id: I6d22cd160d097c50703dd96e4f453c6c118fd5d9 Reviewed-on: https://go-review.googlesource.com/c/go/+/423514 Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Alan Donovan <adonovan@google.com> (cherry picked from commit 0765da5) Reviewed-on: https://go-review.googlesource.com/c/go/+/425357 Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>

…JoinPath JoinPath would fail to remove relative elements from the start of the path when the first path element is "". In addition, JoinPath would return the original path unmodified when provided with no elements to join, violating the documented behavior of always cleaning the resulting path. Correct both these cases. JoinPath("http://go.dev", "../go") // before: http://go.dev/../go // after: http://go.dev/go JoinPath("http://go.dev/../go") // before: http://go.dev/../go // after: http://go.dev/go For golang#54385. Fixes golang#54635. Fixes CVE-2022-32190. Change-Id: I6d22cd160d097c50703dd96e4f453c6c118fd5d9 Reviewed-on: https://go-review.googlesource.com/c/go/+/423514 Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Alan Donovan <adonovan@google.com> (cherry picked from commit 0765da5) Reviewed-on: https://go-review.googlesource.com/c/go/+/425357 Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>

wqwljz · 2022-09-15T11:51:34Z

I use versions earlier than 1.18, such as 1.17. Do I need to upgrade to 1.18？

Includes fixes for security vulnerabilities: * [CVE-2022-27664](GHSA-69cg-p879-7622) net/http: handle server errors after sending GOAWAY * [CVE-2022-32190](golang/go#54385) net/url: JoinPath does not strip relative path components in all circumstances * [CVE-2022-2879](golang/go#54853) archive/tar: unbounded memory consumption when reading headers * [CVE-2022-2880](golang/go#54663) net/http/httputil: ReverseProxy should not forward unparseable query parameters * [CVE-2022-41715](golang/go#55949) regexp/syntax: limit memory used by parsing regexps Addresses the build failure: * openwrt#19613 Signed-off-by: Stanislav Petrashov <s@petrashov.ru>

Includes fixes for security vulnerabilities: * [CVE-2022-27664](GHSA-69cg-p879-7622) net/http: handle server errors after sending GOAWAY * [CVE-2022-32190](golang/go#54385) net/url: JoinPath does not strip relative path components in all circumstances * [CVE-2022-2879](golang/go#54853) archive/tar: unbounded memory consumption when reading headers * [CVE-2022-2880](golang/go#54663) net/http/httputil: ReverseProxy should not forward unparseable query parameters * [CVE-2022-41715](golang/go#55949) regexp/syntax: limit memory used by parsing regexps Addresses the build failure: * openwrt/packages#19613 Signed-off-by: Stanislav Petrashov <s@petrashov.ru> Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

Includes fixes for security vulnerabilities: * [CVE-2022-27664](GHSA-69cg-p879-7622) net/http: handle server errors after sending GOAWAY * [CVE-2022-32190](golang/go#54385) net/url: JoinPath does not strip relative path components in all circumstances * [CVE-2022-2879](golang/go#54853) archive/tar: unbounded memory consumption when reading headers * [CVE-2022-2880](golang/go#54663) net/http/httputil: ReverseProxy should not forward unparseable query parameters * [CVE-2022-41715](golang/go#55949) regexp/syntax: limit memory used by parsing regexps Addresses the build failure: * #19613 Signed-off-by: Stanislav Petrashov <s@petrashov.ru> (cherry picked from commit 0ad7a2f)

Includes fixes for security vulnerabilities: * [CVE-2022-27664](GHSA-69cg-p879-7622) net/http: handle server errors after sending GOAWAY * [CVE-2022-32190](golang/go#54385) net/url: JoinPath does not strip relative path components in all circumstances * [CVE-2022-2879](golang/go#54853) archive/tar: unbounded memory consumption when reading headers * [CVE-2022-2880](golang/go#54663) net/http/httputil: ReverseProxy should not forward unparseable query parameters * [CVE-2022-41715](golang/go#55949) regexp/syntax: limit memory used by parsing regexps Addresses the build failure: * openwrt#19613 Signed-off-by: Stanislav Petrashov <s@petrashov.ru>

gopherbot · 2022-12-22T03:14:00Z

Change https://go.dev/cl/458775 mentions this issue: cmd api NewWalker Reducing the code makes the code more concise

Includes fixes for security vulnerabilities: * [CVE-2022-27664](GHSA-69cg-p879-7622) net/http: handle server errors after sending GOAWAY * [CVE-2022-32190](golang/go#54385) net/url: JoinPath does not strip relative path components in all circumstances * [CVE-2022-2879](golang/go#54853) archive/tar: unbounded memory consumption when reading headers * [CVE-2022-2880](golang/go#54663) net/http/httputil: ReverseProxy should not forward unparseable query parameters * [CVE-2022-41715](golang/go#55949) regexp/syntax: limit memory used by parsing regexps Addresses the build failure: * openwrt#19613 Signed-off-by: Stanislav Petrashov <s@petrashov.ru> (cherry picked from commit 0ad7a2f)

Includes fixes for security vulnerabilities: * [CVE-2022-27664](GHSA-69cg-p879-7622) net/http: handle server errors after sending GOAWAY * [CVE-2022-32190](golang/go#54385) net/url: JoinPath does not strip relative path components in all circumstances * [CVE-2022-2879](golang/go#54853) archive/tar: unbounded memory consumption when reading headers * [CVE-2022-2880](golang/go#54663) net/http/httputil: ReverseProxy should not forward unparseable query parameters * [CVE-2022-41715](golang/go#55949) regexp/syntax: limit memory used by parsing regexps Addresses the build failure: * openwrt/packages#19613 Signed-off-by: Stanislav Petrashov <s@petrashov.ru> (cherry picked from commit 0ad7a2f)

xuyang2 · 2023-07-10T06:43:55Z

I use versions earlier than 1.18, such as 1.17. Do I need to upgrade to 1.18？

#54634 (comment)

Includes fixes for security vulnerabilities: * [CVE-2022-27664](GHSA-69cg-p879-7622) net/http: handle server errors after sending GOAWAY * [CVE-2022-32190](golang/go#54385) net/url: JoinPath does not strip relative path components in all circumstances * [CVE-2022-2879](golang/go#54853) archive/tar: unbounded memory consumption when reading headers * [CVE-2022-2880](golang/go#54663) net/http/httputil: ReverseProxy should not forward unparseable query parameters * [CVE-2022-41715](golang/go#55949) regexp/syntax: limit memory used by parsing regexps Addresses the build failure: * openwrt/packages#19613 Signed-off-by: Stanislav Petrashov <s@petrashov.ru> (cherry picked from commit 0ad7a2f)

neild added the Security label Aug 11, 2022

neild self-assigned this Aug 11, 2022

cuishuang mentioned this issue Aug 11, 2022

net/url: strip relative path components for JoinPath #54390

Merged

seankhliao added this to the Go1.20 milestone Aug 20, 2022

This was referenced Aug 23, 2022

net/url: JoinPath doesn't strip relative path components in all circumstances [1.18 backport] #54634

Closed

net/url: JoinPath doesn't strip relative path components in all circumstances [1.19 backport] #54635

Closed

gopherbot closed this as completed in 0765da5 Aug 23, 2022

dmitshur added the NeedsFix The path to resolution is known, but the work has not been done. label Sep 6, 2022

aidan-kwon mentioned this issue Sep 13, 2022

Update golang version klaytn/klaytn#1625

Closed

Bruc3Stark mentioned this issue Sep 14, 2022

Security Concern: Update golang version to 1.18.6 or 1.19.1 go-gitea/gitea#21167

Closed

huangzhiran mentioned this issue Sep 19, 2022

Do we need to upgrade the golang version? iotexproject/iotex-core#3640

Closed

1 task

Bruc3Stark mentioned this issue Sep 21, 2022

Security Concern: Update golang version to 1.18.6 or 1.19.1 casdoor/casdoor#1150

Closed

wormi4ok mentioned this issue Oct 20, 2022

golang: update to v1.19.2 openwrt/packages#19652

Merged

Fryguy mentioned this issue Nov 8, 2022

Upgrade Go ManageIQ/manageiq-pods#914

Merged

wjw1758548031 mentioned this issue Dec 22, 2022

cmd api NewWalker Reducing the code makes the code more concise #57423

Closed

wjw1758548031 mentioned this issue Dec 22, 2022

cmd api NewWalker Reducing the code makes the code more concise #57439

Closed

komuw mentioned this issue Sep 2, 2023

should we do anything about path traversal issues? komuw/ong#381

Closed

golang locked and limited conversation to collaborators Jul 9, 2024

gopherbot added the FrozenDueToAge label Jul 9, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

net/url: JoinPath doesn't strip relative path components in all circumstances #54385

net/url: JoinPath doesn't strip relative path components in all circumstances #54385

neild commented Aug 11, 2022

neild commented Aug 11, 2022

q0jt commented Aug 11, 2022 •

edited

Loading

gopherbot commented Aug 12, 2022

gopherbot commented Aug 13, 2022

cuishuang commented Aug 16, 2022

q0jt commented Aug 16, 2022 •

edited

Loading

neild commented Aug 23, 2022

gopherbot commented Aug 23, 2022

gopherbot commented Aug 24, 2022

wqwljz commented Sep 15, 2022

gopherbot commented Dec 22, 2022

xuyang2 commented Jul 10, 2023

net/url: JoinPath doesn't strip relative path components in all circumstances #54385

net/url: JoinPath doesn't strip relative path components in all circumstances #54385

Comments

neild commented Aug 11, 2022

neild commented Aug 11, 2022

q0jt commented Aug 11, 2022 • edited Loading

gopherbot commented Aug 12, 2022

gopherbot commented Aug 13, 2022

cuishuang commented Aug 16, 2022

q0jt commented Aug 16, 2022 • edited Loading

neild commented Aug 23, 2022

gopherbot commented Aug 23, 2022

gopherbot commented Aug 24, 2022

wqwljz commented Sep 15, 2022

gopherbot commented Dec 22, 2022

xuyang2 commented Jul 10, 2023

q0jt commented Aug 11, 2022 •

edited

Loading

q0jt commented Aug 16, 2022 •

edited

Loading