Skip to content

Releases: cyphar/filepath-securejoin

v0.2.4

06 Sep 05:20
v0.2.4
2710d06
Compare
Choose a tag to compare

This release fixes a potential security issue in filepath-securejoin
when used on Windows (GHSA-6xv5-86q9-7xr8, which could be used to
generate paths outside of the provided rootfs in certain cases), as well
as improving the overall behaviour of filepath-securejoin when dealing
with Windows paths that contain volume names. Thanks to Paulo Gomes for
discovering and fixing these issues.

In addition, we've switched (at long last) to GitHub Actions and have
continuous integration testing on Linux, MacOS, and Windows.

Thanks to the following contributors for making this release possible:

Signed-off-by: Aleksa Sarai [email protected]

v0.2.3

04 Jul 11:20
v0.2.3
8f267f5
Compare
Choose a tag to compare

This release removes the dependency on github.com/pkg/errors in favour
of Go's built-in %w error wrapping support (available since Go 1.13).
Thanks to the following contributors for making this release possible:

Signed-off-by: Aleksa Sarai [email protected]

v0.2.2

05 Sep 11:09
v0.2.2
a261ee3
Compare
Choose a tag to compare

This release just has a minor change to how symlink loops are indicated
to users (as a wrapped syscall.ELOOP rather than our own special error
message) so that users can just use errors.Cause and not care about our
error variable.

Signed-off-by: Aleksa Sarai [email protected]

v0.2.1

04 Sep 16:58
v0.2.1
06bda83
Compare
Choose a tag to compare

This version adds our own IsNotExist implementation, which is necessary
for handling ENOTDIR properly with SecureJoin.

Signed-off-by: Aleksa Sarai [email protected]

v0.2.0

19 Jul 07:46
v0.2.0
6985b95
Compare
Choose a tag to compare

This now has 100% test coverage, as well as providing a mockable
SecureJoinVFS API that can be used by end-users.

Signed-off-by: Aleksa Sarai [email protected]

v0.1.0

19 Jul 01:10
v0.1.0
57b83d1
Compare
Choose a tag to compare

First release of filepath-securejoin, containing a full implementation
with a coverage of 93.5% (the only missing cases are the error cases,
which are hard to mocktest).

Signed-off-by: Aleksa Sarai [email protected]