Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

filepath.EvalSymlinks vulnerability

Open
  • Is something wrong?
#17 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Active
Tech stack
go
Domain
security

Research direction

The issue names filepath.EvalSymlinks and asks how a symlink inside the root could resolve to a path outside it; no file is named, so start by searching the Go source for EvalSymlinks and for the root-path check around it. Build a small case with a symlink under the root that points outside and see whether the current code lets it through. Done means the check rejects such escapes and a test covers the case. The issue does not say what behaviour is wanted, so confirm the expected fix with the maintainer first.

Written by the indexing model from the issue text.

Description

security

Look into how a symlink inside root could point outside of the path and increase the security

Dominant language
Go
Stars
1
Forks
2
Avg merge
1h 46m
Merged PRs (30d)
6

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Edwin-metcalf/MetCode

All issues in Edwin-metcalf/MetCode

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.