Post #1496100
2026-02-16 21:08 UTC
@cyphar @brauner I tried to first canonicalize the path (resolve symlinks, remove ./ and ../) and then check if the resulting path is still a subpath of the target root. I can see a few ways it differs from these two, but I don't know if those are security issues?
Replies (1)
-
@datenwolf@chaos.social 2026-02-17 07:56
@dascandy @cyphar @brauner The difficulties in correctly implementing path traversal begins with even deciding on something as simple as if `../` should be interpreted within linked list of path components (i.e. collapsing & removing parts of the path spec), or if they should be interpreted within the global namespace. There's no definitive specification how to handle this, so behavior may be different between programs.