GO-W4001 · Potential issue in `filepath.Join()` function calls

Potential issue in filepath.Join() function calls GO-W4001

Anti-pattern

Major

5 months ago — a year old

".git/HEAD" contains a path separator

149			err = os.Mkdir(filepath.Join(input1, ".git/objects"), 0755)
150			Expect(err).NotTo(HaveOccurred())
151
152			gitHEADPath := filepath.Join(input1, ".git/HEAD")153			err = os.WriteFile(gitHEADPath, []byte(`ref: refs/heads/master`), 0644)
154			Expect(err).NotTo(HaveOccurred())
155

".git/objects" contains a path separator

testflight/flying_test.go

146			err = os.Mkdir(filepath.Join(input1, ".git/refs"), 0755)
147			Expect(err).NotTo(HaveOccurred())
148
149			err = os.Mkdir(filepath.Join(input1, ".git/objects"), 0755)150			Expect(err).NotTo(HaveOccurred())
151
152			gitHEADPath := filepath.Join(input1, ".git/HEAD")

".git/refs" contains a path separator

testflight/flying_test.go

143			err = os.Mkdir(filepath.Join(input1, ".git"), 0755)
144			Expect(err).NotTo(HaveOccurred())
145
146			err = os.Mkdir(filepath.Join(input1, ".git/refs"), 0755)147			Expect(err).NotTo(HaveOccurred())
148
149			err = os.Mkdir(filepath.Join(input1, ".git/objects"), 0755)

"/hosts" contains a path separator

worker/runtime/file_store_test.go

82}
83
84func (s *FileStoreSuite) TestContainerIpLookup() {
85	_, err := s.store.Create(filepath.Join("some-handle", "/hosts"), []byte("10.80.0.42 some-handle\n"))86	s.NoError(err)
87
88	ip, err := s.store.ContainerIpLookup("some-handle")

"/hosts" contains a path separator

worker/runtime/file_store.go

 87func (f fileStore) ContainerIpLookup(handle string) (string, error) {
 88	absPath := filepath.Join(f.root, handle)
 89
 90	hc := txeh.HostsConfig{ReadFilePath: filepath.Join(absPath, "/hosts")} 91	hosts, err := txeh.NewHosts(&hc)
 92	if err != nil {
 93		return "", fmt.Errorf("error reading hosts file: %w", err)

Description

Package path/filepath implements utility routines for manipulating filename paths in a way compatible with the target operating system-defined file paths.

As the implementation automatically decides the path separator based on the target operating system, it is recommended to not include backward or forward slash in any of the arguments to filepath.Join as it might result in improper filepaths.

The filepath package uses either forward slashes or backslashes, depending on the operating system. To process paths such as URLs that always use forward slashes regardless of the operating system, path package is used.

Bad practice

// Target OS: Windows (forward slash won't be cleaned anymore as target OS expects backward slash)
filepath.Join("dir/", filename)

concourse / concourse

Bad practice

Recommended