From 985108de87e7d2ecb2b28cb53b323d530387b884 Mon Sep 17 00:00:00 2001 From: Ian Lance Taylor Date: Thu, 31 Mar 2022 13:21:39 -0700 Subject: [PATCH 2/4] net/url: preserve a trailing slash in JoinPath Fixes #52074 Change-Id: I30897f32e70a6ca0c4e11aaf07088c27336efaba Reviewed-on: https://go-review.googlesource.com/c/go/+/397256 Trust: Ian Lance Taylor Run-TryBot: Ian Lance Taylor TryBot-Result: Gopher Robot Reviewed-by: Matt Layher Trust: Matt Layher Upstream-Status: Backport [https://github.com/golang/go/commit/dbb52cc9f3e83a3040f46c2ae7650c15ab342179] CVE: CVE-2022-32190 Signed-off-by: Shubham Kulkarni --- src/net/url/url.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/net/url/url.go b/src/net/url/url.go index dea8bfe..3436707 100644 --- a/src/net/url/url.go +++ b/src/net/url/url.go @@ -1107,11 +1107,18 @@ func (u *URL) UnmarshalBinary(text []byte) error { // JoinPath returns a new URL with the provided path elements joined to // any existing path and the resulting path cleaned of any ./ or ../ elements. +// Any sequences of multiple / characters will be reduced to a single /. func (u *URL) JoinPath(elem ...string) *URL { url := *u if len(elem) > 0 { elem = append([]string{u.Path}, elem...) - url.setPath(path.Join(elem...)) + p := path.Join(elem...) + // path.Join will remove any trailing slashes. + // Preserve at least one. + if strings.HasSuffix(elem[len(elem)-1], "/") && !strings.HasSuffix(p, "/") { + p += "/" + } + url.setPath(p) } return &url } -- 2.7.4