loop error message contains a non-existent path

[eriksjolund]

The error message that is triggered by too many symlink dereferences contains a non-existent path instead of the path to the symlink that causes the loop.

The path is set here:

filepath-securejoin/join.go

Line 58 in b69b737

return "", &os.PathError{Op: "SecureJoin", Path: root + string(filepath.Separator) + unsafePath, Err: syscall.ELOOP}

Steps to reproduce the issue

On Fedora CoreOS perform the following steps

1. mkdir ~/test
2. cd ~/test
3. create the file Dockerfile with this contents

   FROM docker.io/library/fedora:38
   RUN dnf install -y golang
   

4. podman build -t go .
5. create the file reproducer.go with this contents

   package main
   import (
       "os"
       "errors"
       "fmt"
       securejoin "github.com/cyphar/filepath-securejoin"
   )
   func main() {
     path := "/root/sub"
     os.MkdirAll(path, 0755)
     target := "symlink"
     symlink := "/root/sub/symlink"
     os.Symlink(target, symlink)
     _, err := securejoin.SecureJoin("/root","sub/symlink")
     if (err != nil) {
       var pErr *os.PathError
       if errors.As(err, &pErr) {
         fmt.Printf("Error = %v\n", pErr.Err)
         fmt.Printf("Path = %v\n", pErr.Path)
       }
     }
   }

6. podman run --rm -v ./:/src:Z -w /src localhost/go go mod init reproducer
7. podman run --rm -v ./:/src:Z -w /src localhost/go go mod tidy
8. podman run --rm -v ./:/src:Z -w /src localhost/go go run .
   The command prints

   go: downloading github.com/cyphar/filepath-securejoin v0.2.4
   Error = too many levels of symbolic links
   Path = /root/symlink/
   

Describe the results you received

At step 8 I see

Path = /root/symlink/

Describe the results you expected

At step 8 I would have expected to see

Path = /root/sub/symlink

as /root/sub/symlink is the path to the symlink that points to itself. The path /root/symlink/ does not exist.

Comment

I'm not blocked by this issue in any way. Probably this issue is of low importance.

[cyphar]

Sorry for not seeing this bug before (it seems that I wasn't getting notifications for this repo). I fixed this in 87bc53a.