revert to path.Clean for FS path

Author: aldas

echo.go

@@ -54,6 +54,7 @@ import (
 	"net/url"
 	"os"
 	"os/signal"
+	"path"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -622,7 +623,10 @@ func StaticDirectoryHandler(fileSystem fs.FS, disablePathUnescaping bool) Handle
 
 		// fs.FS.Open() already assumes that file names are relative to FS root path and considers name with prefix `/`
 		// as invalid
-		name := filepath.ToSlash(filepath.Clean(strings.TrimPrefix(p, "/")))
+		// Use path.Clean (not filepath.Clean): fs.FS paths are always forward-slash, so a backslash must stay a literal
+		// character rather than being interpreted as a separator on Windows (which would resolve a file across a boundary
+		// the router never matched on, the same Windows backslash traversal class as GHSA-pgvm-wxw2-hrv9).
+		name := path.Clean(strings.TrimPrefix(p, "/"))
 		fi, err := fs.Stat(fileSystem, name)
 		if err != nil {
 			return ErrNotFound

static_encoded_separator_test.go

@@ -12,65 +12,113 @@ import (
 // Regression for GHSA-vfp3-v2gw-7wfq: an encoded slash (%2F) must not let a static
 // file request resolve across a path separator and bypass route-level middleware.
 func TestStaticDirectoryHandler_EncodedSeparatorDoesNotBypassRoute(t *testing.T) {
-	fsys := fstest.MapFS{
-		"admin/secret.txt": {Data: []byte("TOP-SECRET")},
-		"index.html":       {Data: []byte("public")},
-	}
-	e := New()
-	g := e.Group("/admin", func(next HandlerFunc) HandlerFunc {
-		return func(c *Context) error { return c.String(http.StatusForbidden, "denied") }
-	})
-	g.GET("/*", func(c *Context) error { return c.String(http.StatusOK, "reached-protected-handler") })
-	e.StaticFS("/", fsys)
-
-	cases := []struct {
+	var testCases = []struct {
+		name     string
 		target   string
 		wantCode int
 		wantBody string
 	}{
-		{"/admin/secret.txt", http.StatusForbidden, "denied"}, // protected route fires
-		{"/admin%2Fsecret.txt", http.StatusNotFound, ""},      // encoded slash rejected, no disclosure
-		{"/admin%2fsecret.txt", http.StatusNotFound, ""},      // lower-case hex variant
-		{"/admin%5Csecret.txt", http.StatusNotFound, ""},      // encoded backslash variant
-		{"/admin%252Fsecret.txt", http.StatusNotFound, ""},    // double-encoded: single unescape -> literal filename, not a separator
-		{"/index.html", http.StatusOK, "public"},              // legitimate static file still served
+		{
+			name:     "protected route fires",
+			target:   "/admin/secret.txt",
+			wantCode: http.StatusForbidden,
+			wantBody: "denied",
+		},
+		{
+			name:     "encoded slash rejected, no disclosure",
+			target:   "/admin%2Fsecret.txt",
+			wantCode: http.StatusNotFound,
+			wantBody: "",
+		},
+		{
+			name:     "lower-case hex variant",
+			target:   "/admin%2fsecret.txt",
+			wantCode: http.StatusNotFound,
+			wantBody: "",
+		},
+		{
+			name:     "encoded backslash variant - Windows specific related",
+			target:   "/admin%5Csecret.txt",
+			wantCode: http.StatusNotFound,
+			wantBody: "",
+		},
+		{
+			name:     "double-encoded: single unescape -> literal filename, not a separator",
+			target:   "/admin%252Fsecret.txt",
+			wantCode: http.StatusNotFound,
+			wantBody: "",
+		},
+		{
+			name:     "legitimate static file still served",
+			target:   "/index.html",
+			wantCode: http.StatusOK,
+			wantBody: "public",
+		},
 	}
-	for _, tc := range cases {
-		req := httptest.NewRequest(http.MethodGet, tc.target, nil)
-		rec := httptest.NewRecorder()
-		e.ServeHTTP(rec, req)
-		assert.Equal(t, tc.wantCode, rec.Code, "GET %s", tc.target)
-		if tc.wantBody != "" {
-			assert.Equal(t, tc.wantBody, rec.Body.String(), "GET %s", tc.target)
-		}
-		assert.NotContains(t, rec.Body.String(), "TOP-SECRET", "GET %s leaked protected file", tc.target)
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			fsys := fstest.MapFS{
+				"admin/secret.txt": {Data: []byte("TOP-SECRET")},
+				"index.html":       {Data: []byte("public")},
+			}
+			e := New()
+			g := e.Group("/admin", func(next HandlerFunc) HandlerFunc {
+				return func(c *Context) error { return c.String(http.StatusForbidden, "denied") }
+			})
+			g.GET("/*", func(c *Context) error { return c.String(http.StatusOK, "reached-protected-handler") })
+			e.StaticFS("/", fsys)
+
+			req := httptest.NewRequest(http.MethodGet, tc.target, nil)
+			rec := httptest.NewRecorder()
+			e.ServeHTTP(rec, req)
+			assert.Equal(t, tc.wantCode, rec.Code, "GET %s", tc.target)
+			if tc.wantBody != "" {
+				assert.Equal(t, tc.wantBody, rec.Body.String(), "GET %s", tc.target)
+			}
+			assert.NotContains(t, rec.Body.String(), "TOP-SECRET", "GET %s leaked protected file", tc.target)
+		})
 	}
 }
 
 // A Group-mounted StaticFS shares StaticDirectoryHandler, so it must reject the
 // same encoded separators when served under a non-root prefix.
 func TestGroupStaticFS_EncodedSeparatorDoesNotBypassRoute(t *testing.T) {
-	fsys := fstest.MapFS{
-		"admin/secret.txt": {Data: []byte("TOP-SECRET")},
-		"index.html":       {Data: []byte("public")},
-	}
-	e := New()
-	g := e.Group("/files")
-	g.StaticFS("/", fsys)
-
-	cases := []struct {
+	var testCases = []struct {
+		name     string
 		target   string
 		wantCode int
 	}{
-		{"/files/index.html", http.StatusOK},
-		{"/files/admin%2Fsecret.txt", http.StatusNotFound},
-		{"/files/admin%5Csecret.txt", http.StatusNotFound},
+		{
+			name:     "ok",
+			target:   "/files/index.html",
+			wantCode: http.StatusOK,
+		},
+		{
+			name:     "nok, encoded slash",
+			target:   "/files/admin%2Fsecret.txt",
+			wantCode: http.StatusNotFound,
+		},
+		{
+			name:     "nok encoded backslash",
+			target:   "/files/admin%5Csecret.txt",
+			wantCode: http.StatusNotFound,
+		},
 	}
-	for _, tc := range cases {
-		req := httptest.NewRequest(http.MethodGet, tc.target, nil)
-		rec := httptest.NewRecorder()
-		e.ServeHTTP(rec, req)
-		assert.Equal(t, tc.wantCode, rec.Code, "GET %s", tc.target)
-		assert.NotContains(t, rec.Body.String(), "TOP-SECRET", "GET %s leaked protected file", tc.target)
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			fsys := fstest.MapFS{
+				"admin/secret.txt": {Data: []byte("TOP-SECRET")},
+				"index.html":       {Data: []byte("public")},
+			}
+			e := New()
+			g := e.Group("/files")
+			g.StaticFS("/", fsys)
+
+			req := httptest.NewRequest(http.MethodGet, tc.target, nil)
+			rec := httptest.NewRecorder()
+			e.ServeHTTP(rec, req)
+			assert.Equal(t, tc.wantCode, rec.Code, "GET %s", tc.target)
+			assert.NotContains(t, rec.Body.String(), "TOP-SECRET", "GET %s leaked protected file", tc.target)
+		})
 	}
 }