path/filepath: Clean(`.\c:`) returns `c:` on Windows

[Unrud]

What version of Go are you using (go version)?

$ go version
go version go1.18.1 windows/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
set GO111MODULE=
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\user\AppData\Local\go-build
set GOENV=C:\Users\user\AppData\Roaming\go\env
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\user\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=C:\Users\user\go
set GOPRIVATE=
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=C:\Program Files\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLDIR=C:\Program Files\Go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.18.1
set GCCGO=gccgo
set GOAMD64=v1
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=NUL
set GOWORK=
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=C:\Users\user\AppData\Local\Temp\go-build3120958786=/tmp/go-build -gno-record-gcc-switches

What did you do?

filepath.Clean(`.\c:`)     // `c:`     Input is an invalid path; Output points to drive C
filepath.Clean(`.\c:\foo`) // `c:\foo` Input is an invalid path; Output is an absolute path
filepath.Clean(`.\c:foo`)  // `c:foo`  Input points to ADS `foo` of file `.\c`; Output points to `foo` on drive C

What did you expect to see?

That the paths are equivalent.

What did you see instead?

They are not equivalent.

Implications

It can lead to unexpected behavior:

package main

import "net/http"

func main() {
	http.ListenAndServe(":8080", http.FileServer(http.Dir(".")))
}

http://localhost:8080/c:/Users/ lists the directory content of C:\Users\.

[mattn]

Clean must NOT remove prefix .\ when following element is possibly absolute paths.

diff --git a/src/path/filepath/path.go b/src/path/filepath/path.go
index ec9e6d8a1f..d6257b9fe5 100644
--- a/src/path/filepath/path.go
+++ b/src/path/filepath/path.go
@@ -117,9 +117,18 @@ func Clean(path string) string {
 		case os.IsPathSeparator(path[r]):
 			// empty path element
 			r++
-		case path[r] == '.' && (r+1 == n || os.IsPathSeparator(path[r+1])):
+		case path[r] == '.' && r+1 == n:
 			// . element
 			r++
+		case path[r] == '.' && os.IsPathSeparator(path[r+1]):
+			// ./ element
+			r++
+			for os.IsPathSeparator(path[r]) {
+				r++
+			}
+			if out.w == 0 && IsAbs(path[r:]) {
+				return originalPath
+			}
 		case path[r] == '.' && path[r+1] == '.' && (r+2 == n || os.IsPathSeparator(path[r+2])):
 			// .. element: remove to last separator
 			r += 2

[mattn]

Hmm, this patch still have problem. When the base path is C and requested path is :, result become C:\. To completely fix this issue, we should fix . in http.Dir to be absolute path.

[gopherbot]

Change https://go.dev/cl/401595 mentions this issue: path/filepath: do not remove prefix "." when following element is absolute paths.

[mattn]

@ianlancetaylor This is security issue. So we have to make backports for older versions.

[ianlancetaylor]

@gopherbot Please open backport issues.

Avoid confusion with ./C: paths.

[gopherbot]

Backport issue(s) opened: #52478 (for 1.17), #52479 (for 1.18).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/405234 mentions this issue: [release-branch.go1.18] path/filepath: do not remove prefix "." when following path contains ":"

[gopherbot]

Change https://go.dev/cl/405235 mentions this issue: [release-branch.go1.17] path/filepath: do not remove prefix "." when following path contains ":"