From 977d9993820d4facd87953a96d3680ba13e27f9c Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 1 Sep 2026 21:39:01 +0200 Subject: [PATCH] cli/config: use filepath.IsLocal to validate config paths Use filepath.Rel and filepath.IsLocal instead of comparing path prefixes as strings when checking that a path stays within the config directory. Also avoid calling Dir multiple times when constructing and validating the path. Signed-off-by: Sebastiaan van Stijn --- cli/config/config.go | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/cli/config/config.go b/cli/config/config.go index 5a63780509..a7ea0acdd7 100644 --- a/cli/config/config.go +++ b/cli/config/config.go @@ -7,7 +7,6 @@ import ( "os/user" "path/filepath" "runtime" - "strings" "sync" "github.com/docker/cli/cli/config/configfile" @@ -98,9 +97,11 @@ func SetDir(dir string) { // Path returns the path to a file relative to the config dir func Path(p ...string) (string, error) { - path := filepath.Join(append([]string{Dir()}, p...)...) - if !strings.HasPrefix(path, Dir()+string(filepath.Separator)) { - return "", fmt.Errorf("path %q is outside of root config directory %q", path, Dir()) + root := Dir() + path := filepath.Join(append([]string{root}, p...)...) + + if rel, err := filepath.Rel(root, path); err != nil || !filepath.IsLocal(rel) { + return "", fmt.Errorf("path %q is outside of root config directory %q", path, root) } return path, nil }