security: fix Windows path traversal in sanitizedPathJoin

Caught by FuzzSanitizedPathJoin on Windows CI: sanitizedPathJoin("",
"/../../../etc/passwd") returned "..\..\etc\passwd" - the traversal
escaped root instead of being neutralized.

reqPath is an HTTP request path (always "/"-separated, regardless of
host OS), but the code cleaned it with filepath.Clean, which uses
native-separator, native-OS rules. On Windows, filepath.Clean does not
treat a driveless "/"-rooted path as absolute, so a leading ".." isn't
collapsed at the root the way it is on POSIX - it survives into the
joined path instead of being dropped.

Fixed by cleaning reqPath with the "path" package (POSIX-only, no
OS-dependent branching) before handing it to filepath.Join for the
native-separator join onto root. path.Clean deterministically produces
the same traversal-free result on every platform, so there's no
leftover ".." left for filepath's OS-specific rules to mishandle.

Author: dunglas

cgi.go

@@ -18,6 +18,7 @@ import (
 	"crypto/tls"
 	"net"
 	"net/http"
+	"path"
 	"path/filepath"
 	"strings"
 	"unicode/utf8"
@@ -338,17 +339,25 @@ func sanitizedPathJoin(root, reqPath string) string {
 		root = "."
 	}
 
-	path := filepath.Join(root, filepath.Clean("/"+reqPath))
+	// reqPath is an HTTP request path: always "/"-separated, regardless of
+	// host OS. It must be cleaned with the "path" package (POSIX-only),
+	// not "path/filepath": on Windows, filepath.Clean does not treat a
+	// driveless "/"-rooted path as absolute, so a leading ".." isn't
+	// collapsed at the root the way it is on POSIX - it survives into the
+	// joined path instead, escaping root.
+	cleanedReqPath := filepath.FromSlash(path.Clean("/" + reqPath))
+
+	joined := filepath.Join(root, cleanedReqPath)
 
 	// filepath.Join also cleans the path, and cleaning strips
 	// the trailing slash, so we need to re-add it afterward.
 	// if the length is 1, then it's a path to the root,
 	// and that should return ".", so we don't append the separator.
 	if strings.HasSuffix(reqPath, "/") && len(reqPath) > 1 {
-		path += separator
+		joined += separator
 	}
 
-	return path
+	return joined
 }
 
 // splitRemoteAddr splits "host:port" leniently: a missing port is accepted.