path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4

[calmh]

Go 1.21.4 fixed a problem in filepath.Clean regarding \??\ paths. However, it also removed the ending slash for volumes in \\?\ paths. Is this expected? The docs still state

The returned path ends in a slash only if it represents a root directory, such as "/" on Unix or C:\ on Windows.

The following test passes on Go 1.21.3.

func TestFilepathClean(t *testing.T) {
	cases := []struct {
		in  string
		out string
	}{
		{`C:\`, `C:\`},
		{`\\?\C:\`, `\\?\C:\`},
	}
	for _, c := range cases {
		if out := filepath.Clean(c.in); out != c.out {
			t.Errorf("filepath.Clean(%s) => %s expected %s", c.in, out, c.out)
		}
	}
}

On Go 1.21.4 this happens:

PS C:\Users\jb\dev\syncthing\lib\fs> go1.21.4 test -run FilepathClean
--- FAIL: TestFilepathClean (0.00s)
    basicfs_windows_test.go:30: filepath.Clean(\\?\C:\) => \\?\C: expected \\?\C:\
FAIL
exit status 1
FAIL    github.com/syncthing/syncthing/lib/fs   0.062s

[qmuntal]

Thanks for reporting. Seems like a regression.

@golang/windows @neild

[bcmills]

@gopherbot, please backport to Go 1.21 and maybe 1.20. This appears to be a regression introduced in a security release.

[gopherbot]

Backport issue(s) opened: #64040 (for 1.20), #64041 (for 1.21).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/541175 mentions this issue: path/filepath: consider \\?\c: as a volume on Windows

[neild]

This falls out from an inadvertent change to what we consider the "volume name" to be in paths starting with \\?\. https://go.dev/cl/541175 restores the previous behavior.

[dagood]

I confirmed the CL also fixes another bit of fallout: calling filepath.EvalSymlinks on a path like \\?\Volume{45a4...f138}\ fails with go1.21.4, go1.20.11, and gotip: GetFileInformationByHandle \\?\Volume{45a4...f138}: Incorrect function.. With gotip download 541175, the call succeeds.

Reading the code, this makes sense, but I figured it might still be worth mentioning. 🙂

[gopherbot]

Change https://go.dev/cl/541520 mentions this issue: [release-branch.go1.20] path/filepath: consider \\?\c: as a volume on Windows

[gopherbot]

Change https://go.dev/cl/541521 mentions this issue: [release-branch.go1.21] path/filepath: consider \\?\c: as a volume on Windows

[thaJeztah]

Opened backports for go1.20 and go1.21;

• go1.20: [release-branch.go1.20] path/filepath: consider \\?\c: as a volume on Windows #64091 / https://go-review.googlesource.com/c/go/+/541520
• go1.21: [release-branch.go1.21] path/filepath: consider \\?\c: as a volume on Windows #64092 / https://go-review.googlesource.com/c/go/+/541521

@bcmills do you know if there's an ETA for patch-releases with this fix? It's currently preventing various projects from updating (and thus missing the security fixes)

[gopherbot]

Change https://go.dev/cl/541836 mentions this issue: [release-branch.go1.20] path/filepath: consider \\?\c: as a volume on Windows

[gopherbot]

Change https://go.dev/cl/541837 mentions this issue: [release-branch.go1.21] path/filepath: consider \\?\c: as a volume on Windows

[thaJeztah]

@bcmills do you know if there's an ETAfor go1.20 and 1.21 patch releases with this fix? This regression is currently preventing various projects from updating (and thus patching the CVEs fixed in the latest release)

[thaJeztah]

@rsc @bcmills anyone able to provide info on an ETA for a new patch release?

[bcmills]

Generally patch releases occur monthly, although I'm not sure about the timing for the next releases due to U.S. holidays in November and December. (@golang/release may have a clearer idea of when they will occur.)

[thaJeztah]

Thanks! Yeah, people may get itchy if they run their vulnerability scanner and see "unpatched CVE" on binaries, so was curious if there was an ETA with the patches for this regression.

[dmitshur]

Minor releases are planned for the beginning of each month. I expect the next month's (December) minor releases to follow that pattern.

[thaJeztah]

Gotcha. I wasn't sure if regressions introduced in security releases followed the same schedule, or if there were exceptions to that.

[neild]

Relnote:

Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?\, resulting in filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among other effects). The previous behavior has been restored.

This is an update to CVE-2023-45283 and https://go.dev/issue/64028.