io/ioutil: reject path separators in TempDir, TempFile pattern #33920
Description
In
Line 64 in f882d89
prefix and suffix extracted from the variable pattern are used in filepath.Join. Since there is no filtering in place, this could lead to directory traversal vulnerabilities.
For example, the following value for pattern can create an unexpected behaviour:
ioutil.TempFile("/tmp", path.Base("../../somewhere/else.*.suffix"))
A less-surprising behaviour would be to call path.Base:
name := filepath.Join(dir, path.Base(prefix+nextRandom()+suffix))