Go: Traversal-resistant file APIs

[NewsBot]

A new Go blog post/announcement has been posted!

<div class="Article" data-slug="/blog/osroot">

<h1 class="small"><a href="/blog/">The Go Blog</a></h1>


<h1>Traversal-resistant file APIs</h1>
  
  <p class="author">
  Damien Neil<br>
  12 March 2025
  </p>
  
  <p>A <em>path traversal vulnerability</em> arises when an attacker can trick a program

into opening a file other than the one it intended.
This post explains this class of vulnerability,
some existing defenses against it, and describes how the new
os.Root API added in Go 1.24 provides
a simple and robust defense against unintentional path traversal.

Path traversal attacks

“Path traversal” covers a number of related attacks following a common pattern: A program attempts to open a file in some known location, but an attacker causes it to open a file in a different location.</p...

Get the full details here: Traversal-resistant file APIs - The Go Programming Language