diff --git a/path.go b/path.go index 672213d1..c079cb41 100644 --- a/path.go +++ b/path.go @@ -25,6 +25,13 @@ func cleanPath(p string) string { if p == "" { return "/" } + // Prevent scheme-relative ("//...") or backslash-based absolute ("/\\...") paths. + for len(p) > 1 && p[0] == '/' && p[1] == '/' { + p = p[1:] + } + if len(p) > 1 && p[0] == '/' && p[1] == '\\' { + p = "/" + p[2:] + } // Reasonably sized buffer on stack to avoid allocations in the common case. // If a larger buffer is required, it gets allocated dynamically.