Language: Go
Label: safe
CWE: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Code:
func (fs *Filesystem) SafePath(p string) (string, error) {
	// Start with a cleaned up path before checking the more complex bits.
	r := fs.unsafeFilePath(p)

	// At the same time, evaluate the symlink status and determine where this file or folder
	// is truly pointing to.
	ep, err := filepath.EvalSymlinks(r)
	if err != nil && !os.IsNotExist(err) {
		return "", errors.Wrap(err, "server/filesystem: failed to evaluate symlink")
	} else if os.IsNotExist(err) {
		// The target of one of the symlinks (EvalSymlinks is recursive) does not exist.
		// So we get what target path does not exist and check if it's within the data
		// directory. If it is, we return the original path, otherwise we return an error.
		pErr, ok := err.(*iofs.PathError)
		if !ok {
			return "", errors.Wrap(err, "server/filesystem: failed to evaluate symlink")
		}
		ep = pErr.Path
	}

	// If the requested directory from EvalSymlinks begins with the server root directory go
	// ahead and return it. If not we'll return an error which will block any further action
	// on the file.
	if fs.unsafeIsInDataDirectory(ep) {
		// Returning the original path here instead of the resolved path ensures that
		// whatever the user is trying to do will work as expected. If we returned the
		// resolved path, the user would be unable to know that it is in fact a symlink.
		return r, nil
	}

	return "", NewBadPathResolution(p, r)
}