Skip to content

v0.4.1

Latest
Compare
Choose a tag to compare
@cyphar cyphar released this 28 Jan 08:30
· 2 commits to main since this release
v0.4.1
7abd870

This release fixes a regression introduced in one of the hardening
features added to filepath-securejoin 0.4.0.

  • The restrictions added for root paths passed to SecureJoin in 0.4.0 was
    found to be too strict and caused some regressions when folks tried to
    update, so this restriction has been relaxed to only return an error if the
    path contains a .. component. We still recommend users use filepath.Clean
    (and even filepath.EvalSymlinks) on the root path they are using, but at
    least you will no longer be punished for "trivial" unclean paths. (#46)

Signed-off-by: Aleksa Sarai [email protected]