Merge 7dbe3741fc111e3cf0daa26c2190d006052321cb into fad706f1216e6d12bdd51d28d5a40ec27e6c6453

chore(deps): bump github.com/goccy/go-yaml from 1.18.0 to 1.19.0 (#4458 )
Bumps [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml) from 1.18.0 to 1.19.0. - [Release notes](https://github.com/goccy/go-yaml/releases) - [Changelog](https://github.com/goccy/go-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/goccy/go-yaml/compare/v1.18.0...v1.19.0) --- updated-dependencies: - dependency-name: github.com/goccy/go-yaml dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-06 10:21:17 +08:00 · 2025-12-02 10:19:47 -03:00 · 2025-12-02 20:09:41 +08:00 · 2025-11-23 14:01:44 +00:00 · 2025-11-23 14:01:27 +00:00 · 2025-11-23 00:44:36 +00:00
7 changed files with 51 additions and 3 deletions
--- a/go.mod
+++ b/go.mod
@ -7,7 +7,7 @@ require (
 	github.com/gin-contrib/sse v1.1.0
 	github.com/go-playground/validator/v10 v10.28.0
 	github.com/goccy/go-json v0.10.2
-	github.com/goccy/go-yaml v1.18.0
+	github.com/goccy/go-yaml v1.19.0
 	github.com/json-iterator/go v1.1.12
 	github.com/mattn/go-isatty v0.0.20
 	github.com/modern-go/reflect2 v1.0.2
--- a/go.sum
+++ b/go.sum
@ -24,8 +24,8 @@ github.com/go-playground/validator/v10 v10.28.0 h1:Q7ibns33JjyW48gHkuFT91qX48KG0
 github.com/go-playground/validator/v10 v10.28.0/go.mod h1:GoI6I1SjPBh9p7ykNE/yj3fFYbyDOpwMn5KXd+m2hUU=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
-github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
-github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/goccy/go-yaml v1.19.0 h1:EmkZ9RIsX+Uq4DYFowegAuJo8+xdX3T/2dwNPXbxEYE=
+github.com/goccy/go-yaml v1.19.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
--- a/routergroup.go
+++ b/routergroup.go
@ -223,6 +223,10 @@ func (group *RouterGroup) createStaticHandler(relativePath string, fs http.FileS
 		}

 		file := c.Param("filepath")
+		file = path.Clean("/" + file)[1:]
+		if file == "" {
+			file = "."
+		}
 		// Check if file exists and/or if we have permission to access it
 		f, err := fs.Open(file)
 		if err != nil {
--- a/routes_test.go
+++ b/routes_test.go
@ -5,7 +5,9 @@
 package gin

 import (
+	"embed"
 	"fmt"
+	"io/fs"
 	"net/http"
 	"net/http/httptest"
 	"os"
@ -646,6 +648,43 @@ func TestRouterStaticFSNotFound(t *testing.T) {
 	assert.Equal(t, "non existent", w.Body.String())
 }

+//go:embed testdata/embed
+var embeddedFolder embed.FS
+
+const embeddedPath = "testdata/embed"
+
+func TestRouteStaticFSCleansPath(t *testing.T) {
+	router := New()
+	subFS, err := fs.Sub(embeddedFolder, embeddedPath)
+	require.NoError(t, err)
+	fs := &OnlyFilesFS{
+		FileSystem: http.FS(subFS),
+	}
+	router.StaticFS("/", fs)
+	router.NoRoute(func(c *Context) {
+		c.String(http.StatusNotFound, "non existent")
+	})
+
+	w := PerformRequest(router, http.MethodGet, "/tutorials/making-gin/")
+	assert.Contains(t, w.Body.String(), "This is another simple embedded page.")
+}
+
+func TestRouteStaticFSNestedJsFile(t *testing.T) {
+	router := New()
+	subFS, err := fs.Sub(embeddedFolder, embeddedPath)
+	require.NoError(t, err)
+	fs := &OnlyFilesFS{
+		FileSystem: http.FS(subFS),
+	}
+	router.StaticFS("/", fs)
+	router.NoRoute(func(c *Context) {
+		c.String(http.StatusNotFound, "non existent")
+	})
+
+	w := PerformRequest(router, http.MethodGet, "/tutorials/making-gin/main.js")
+	assert.Contains(t, w.Body.String(), "console.log(\"This is a simple embedded JavaScript file.\");")
+}
+
 func TestRouterStaticFSFileNotFound(t *testing.T) {
 	router := New()

--- a/testdata/embed/index.html
+++ b/testdata/embed/index.html
@ -0,0 +1,2 @@
+<!DOCTYPE html>
+Hello embedded world!
--- a/testdata/embed/tutorials/making-gin/index.html
+++ b/testdata/embed/tutorials/making-gin/index.html
@ -0,0 +1,2 @@
+<!DOCTYPE html>
+This is another simple embedded page.
--- a/testdata/embed/tutorials/making-gin/main.js
+++ b/testdata/embed/tutorials/making-gin/main.js
@ -0,0 +1 @@
+console.log("This is a simple embedded JavaScript file.");
Author	SHA1	Message	Date
Nico Clack	383ddedb3e	Merge 7dbe3741fc111e3cf0daa26c2190d006052321cb into fad706f1216e6d12bdd51d28d5a40ec27e6c6453	2025-12-02 10:19:47 -03:00
dependabot[bot]	fad706f121	chore(deps): bump github.com/goccy/go-yaml from 1.18.0 to 1.19.0 (#4458 ) Bumps [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml) from 1.18.0 to 1.19.0. - [Release notes](https://github.com/goccy/go-yaml/releases) - [Changelog](https://github.com/goccy/go-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/goccy/go-yaml/compare/v1.18.0...v1.19.0) --- updated-dependencies: - dependency-name: github.com/goccy/go-yaml dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-12-02 20:09:41 +08:00
Nico Clack	7dbe3741fc	Merge branch 'master' into fix-router-static-fs	2025-11-23 14:01:44 +00:00
Nico Clack	8ef5a66294	Add test for nested JavaScript file	2025-11-23 14:01:27 +00:00
Nico Clack	670895b7b2	Fix router.StaticFS	2025-11-23 00:44:36 +00:00
				`@ -0,0 +1 @@`
				`console.log("This is a simple embedded JavaScript file.");`