title: Does Go sanitize URLs for web requests?
body: <p>I was implementing a simple web server in Go. As I have no experience in web development, this striked as a serious question for me. </p>
  
  <p>Let's say I'm serving web pages with a modified <code>loadPage</code> function from <a href="http://golang.org/doc/articles/wiki/" rel="noreferrer">here</a></p>
  
  <pre><code>func loadPage(title string) []byte {
      filename := title 
      body, _ := ioutil.ReadFile(filename)
      return body
  }
  
  func handler(w http.ResponseWriter, req *http.Request) {
      content := loadPage(req.URL.Path[1:])
      fmt.Fprintf(w, "%s", content)
  }
  </code></pre>
  
  <p>Technically this allows me to write a request in a form of </p>
  
  <pre><code> http://example.com/../../etc/passwd
  </code></pre>
  
  <p>and the code would happily serve the /etc/passwd file, but it does not. Does this mean that there is some sort of protection against <code>../</code> in the Go http package or http protocol itself, or am I just doing something wrong and it is a security hole? </p>