Merge 016af753cf0f5a32ae2af9147a5d2e75418e499e into ecb3f7b5e2f3915bf1db240ed5eee572f8dbea36

- Update golang.org/x/crypto dependency to version 0.45.0

1. https://avd.aquasec.com/nvd/cve-2025-47914
2. https://avd.aquasec.com/nvd/cve-2025-58181

Signed-off-by: appleboy <appleboy.tw@gmail.com>

go.mod

@@ -35,7 +35,7 @@ require (
 	github.com/quic-go/qpack v0.5.1 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	golang.org/x/arch v0.20.0 // indirect
-	golang.org/x/crypto v0.44.0 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
 	golang.org/x/sys v0.38.0 // indirect
 	golang.org/x/text v0.31.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

go.sum

@@ -74,8 +74,8 @@ go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
 go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 golang.org/x/arch v0.20.0 h1:dx1zTU0MAE98U+TQ8BLl7XsJbgze2WnNKF/8tGp/Q6c=
 golang.org/x/arch v0.20.0/go.mod h1:bdwinDaKcfZUGpH09BB7ZmOfhalA8lQdzl62l8gGWsk=
-golang.org/x/crypto v0.44.0 h1:A97SsFvM3AIwEEmTBiaxPPTYpDC47w720rdiiUvgoAU=
-golang.org/x/crypto v0.44.0/go.mod h1:013i+Nw79BMiQiMsOPcVCB5ZIJbYkerPrGnOa00tvmc=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
 golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

path.go

@@ -19,18 +19,29 @@ package gin
 //
 // If the result of this process is an empty string, "/" is returned.
 func cleanPath(p string) string {
-	const stackBufSize = 128
 	// Turn empty string into "/"
 	if p == "" {
 		return "/"
 	}
 
+	n := len(p)
+
+	// If the path length is 1, handle special cases separately:
+	// - If it is "/" or ".", return "/".
+	// - Otherwise, prepend "/" to the path and return it.
+	if n == 1 {
+		if p[0] == '/' || p[0] == '.' {
+			return "/"
+		}
+		return "/" + p
+	}
+
+	const stackBufSize = 128
+
 	// Reasonably sized buffer on stack to avoid allocations in the common case.
 	// If a larger buffer is required, it gets allocated dynamically.
 	buf := make([]byte, 0, stackBufSize)
 
-	n := len(p)
-
 	// Invariants:
 	//      reading from path; r is index of next byte to process.
 	//      writing to buf; w is index of next byte to write.
@@ -50,7 +61,7 @@ func cleanPath(p string) string {
 		buf[0] = '/'
 	}
 
-	trailing := n > 1 && p[n-1] == '/'
+	var trailing bool
 
 	// A bit more clunky without a 'lazybuf' like the path package, but the loop
 	// gets completely inlined (bufApp calls).
@@ -58,38 +69,44 @@ func cleanPath(p string) string {
 	// calls (except make, if needed).
 
 	for r < n {
-		switch {
-		case p[r] == '/':
+		switch p[r] {
+		case '/':
 			// empty path element, trailing slash is added after the end
 			r++
 
-		case p[r] == '.' && r+1 == n:
-			trailing = true
-			r++
+		case '.':
+			if r+1 == n {
+				trailing = true
+				r++
+				// Reduce one comparison between r and n
+				goto endOfLoop
+			}
+			switch p[r+1] {
+			case '/':
+				// . element
+				r += 2
 
-		case p[r] == '.' && p[r+1] == '/':
-			// . element
-			r += 2
+			case '.':
+				if r+2 == n || p[r+2] == '/' {
+					// .. element: remove to last /
+					r += 3
 
-		case p[r] == '.' && p[r+1] == '.' && (r+2 == n || p[r+2] == '/'):
-			// .. element: remove to last /
-			r += 3
-
-			if w > 1 {
-				// can backtrack
-				w--
-
-				if len(buf) == 0 {
-					for w > 1 && p[w] != '/' {
-						w--
-					}
-				} else {
-					for w > 1 && buf[w] != '/' {
+					if w > 1 {
+						// can backtrack
 						w--
+
+						if len(buf) == 0 {
+							for w > 1 && p[w] != '/' {
+								w--
+							}
+						} else {
+							for w > 1 && buf[w] != '/' {
+								w--
+							}
+						}
 					}
 				}
 			}
-
 		default:
 			// Real path element.
 			// Add slash if needed
@@ -107,8 +124,9 @@ func cleanPath(p string) string {
 		}
 	}
 
+endOfLoop:
 	// Re-append trailing slash
-	if trailing && w > 1 {
+	if (trailing || p[n-1] == '/') && w > 1 {
 		bufApp(&buf, p, w, '/')
 		w++
 	}

path_test.go

@@ -27,6 +27,7 @@ var cleanTests = []cleanPathTest{
 
 	// missing root
 	{"", "/"},
+	{"a", "/a"},
 	{"a/", "/a/"},
 	{"abc", "/abc"},
 	{"abc/def", "/abc/def"},
@@ -143,3 +144,117 @@ func BenchmarkPathCleanLong(b *testing.B) {
 		}
 	}
 }
+
+func cleanPathOld(p string) string {
+	const stackBufSize = 128
+	// Turn empty string into "/"
+	if p == "" {
+		return "/"
+	}
+
+	// Reasonably sized buffer on stack to avoid allocations in the common case.
+	// If a larger buffer is required, it gets allocated dynamically.
+	buf := make([]byte, 0, stackBufSize)
+
+	n := len(p)
+
+	// Invariants:
+	//      reading from path; r is index of next byte to process.
+	//      writing to buf; w is index of next byte to write.
+
+	// path must start with '/'
+	r := 1
+	w := 1
+
+	if p[0] != '/' {
+		r = 0
+
+		if n+1 > stackBufSize {
+			buf = make([]byte, n+1)
+		} else {
+			buf = buf[:n+1]
+		}
+		buf[0] = '/'
+	}
+
+	trailing := n > 1 && p[n-1] == '/'
+
+	// A bit more clunky without a 'lazybuf' like the path package, but the loop
+	// gets completely inlined (bufApp calls).
+	// loop has no expensive function calls (except 1x make)		// So in contrast to the path package this loop has no expensive function
+	// calls (except make, if needed).
+
+	for r < n {
+		switch {
+		case p[r] == '/':
+			// empty path element, trailing slash is added after the end
+			r++
+
+		case p[r] == '.' && r+1 == n:
+			trailing = true
+			r++
+
+		case p[r] == '.' && p[r+1] == '/':
+			// . element
+			r += 2
+
+		case p[r] == '.' && p[r+1] == '.' && (r+2 == n || p[r+2] == '/'):
+			// .. element: remove to last /
+			r += 3
+
+			if w > 1 {
+				// can backtrack
+				w--
+
+				if len(buf) == 0 {
+					for w > 1 && p[w] != '/' {
+						w--
+					}
+				} else {
+					for w > 1 && buf[w] != '/' {
+						w--
+					}
+				}
+			}
+
+		default:
+			// Real path element.
+			// Add slash if needed
+			if w > 1 {
+				bufApp(&buf, p, w, '/')
+				w++
+			}
+
+			// Copy element
+			for r < n && p[r] != '/' {
+				bufApp(&buf, p, w, p[r])
+				w++
+				r++
+			}
+		}
+	}
+
+	// Re-append trailing slash
+	if trailing && w > 1 {
+		bufApp(&buf, p, w, '/')
+		w++
+	}
+
+	// If the original string was not modified (or only shortened at the end),
+	// return the respective substring of the original string.
+	// Otherwise return a new string from the buffer.
+	if len(buf) == 0 {
+		return p[:w]
+	}
+	return string(buf[:w])
+}
+
+func BenchmarkPathCleanOld(b *testing.B) {
+	b.ReportAllocs()
+
+	for i := 0; i < b.N; i++ {
+		for _, test := range cleanTests {
+			cleanPathOld(test.path)
+		}
+	}
+}