title: Failure to strip relative path components in net/url
description: JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
problem types: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
vendor: Go standard library
product: net/url
collectionURL: https://pkg.go.dev
packageName: net/url
versions:
version: 1.19.0-0, lessThan: 1.19.1, status: affected, versionType: semver
programRoutines:
name: URL.JoinPath
name: JoinPath
defaultStatus: unaffected
}