tree 91d32e7299638b5b2dcdd9f5edb7a50c16cf693f
parent 6f7dac9698988af7b704298c9fd8adf58e1d30c0
author Roland Shoemaker <roland@golang.org> 1653508448 -0700
committer Roland Shoemaker <roland@golang.org> 1653520176 +0000

acme/autocert: properly clean DirCache paths

Don't assume the path passed into the DirCache methods is absolute, and
clean it before further operating on it. Put and Delete are not attacker
controlled, but clean them anyway.

Fixes #53082
Fixes CVE-2022-30636

Change-Id: I755f525a737da60ccba07ebce4d41cc8faebfcca
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/408694
Run-TryBot: Roland Shoemaker <roland@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>