filepath-securejoin

filepath-securejoin copied to clipboard

The error message that is triggered by too many symlink dereferences contains a non-existent path instead of the path to the symlink that causes the loop. The path is set...

eriksjolund

consider migrating to io/fs.StatFS for SecureJoinVFS

1

Now the Go has their own "generic" interfaces for filesystem roots, maybe it would make sense to migrate to using that rather than our own home-brew thing. Note that we...

cyphar

Thanks for this package! As you noted in the README, using `SecureJoin()` before `os.OpenFile()` is not always enough if the path components are modified between the 2 functions. Do you...

alban

It would be fairly trivial to implement this, and I suspect some users will need it. I'm not sure if it makes sense to add to this project though, given...

cyphar

This is based on #13 and is mostly a proof-of-concept to show how `partialLookupInRoot` can be adapted to implement `SecureJoin`. Note that due to the different semantics, there are test...

cyphar