From 9746a42e0441b9a6f318fd52237db265795a0bac Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Sat, 18 Jul 2026 13:36:10 +0000 Subject: [PATCH] Reject backslashes in confined file paths --- internal/core/fileio/fileio.go | 2 +- internal/core/fileio/fileio_test.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/core/fileio/fileio.go b/internal/core/fileio/fileio.go index f02b029..47065f1 100644 --- a/internal/core/fileio/fileio.go +++ b/internal/core/fileio/fileio.go @@ -19,7 +19,7 @@ func SafePath(root, name string) (string, error) { if name == "" { return "", fmt.Errorf("artifact name must not be empty") } - if strings.Contains(name, `\\`) { + if strings.ContainsRune(name, '\\') { return "", fmt.Errorf("artifact name %q must use slash-separated relative paths", name) } if path.IsAbs(name) || filepath.IsAbs(name) { diff --git a/internal/core/fileio/fileio_test.go b/internal/core/fileio/fileio_test.go index 7f2ba00..51d8bfa 100644 --- a/internal/core/fileio/fileio_test.go +++ b/internal/core/fileio/fileio_test.go @@ -8,7 +8,7 @@ import ( ) func TestSafePathRejectsUnsafeNames(t *testing.T) { - for _, name := range []string{"/tmp/x", "a/../x", "a//x", `a\\x`} { + for _, name := range []string{"/tmp/x", "a/../x", "a//x", `a\x`, `a\\x`} { if _, err := SafePath(t.TempDir(), name); err == nil { t.Fatalf("SafePath(%q) accepted unsafe path", name) }