From 965cc3a8ea18071fde39bc8e2696e8067500a139 Mon Sep 17 00:00:00 2001
From: Amariah Kamau <110414493+AmariahAK@users.noreply.github.com>
Date: Fri, 31 Jul 2026 18:23:25 +0300
Subject: [PATCH] =?UTF-8?q?admin:=20fix=20TrimRight=20=E2=86=92=20TrimSuff?=
 =?UTF-8?q?ix=20in=20provisioning=20path=20validation?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

strings.TrimRight strips all trailing slashes, so a configured path
like /foo// passed validation (both slashes trimmed to /foo matching
path.Clean output) but was silently broadened to /foo at runtime.

Use strings.TrimSuffix instead, which removes exactly one trailing
slash — the only form the exemption was meant to allow (users write
/pki/ca/prod/ meaning the /pki/ca/prod scope).

Also update the // test case: with TrimSuffix, // is just / + one
trailing slash, which is valid under the exemption. Add a new test
for /foo// (double trailing slashes → wantErr: true).

Co-authored-by: atlarix-agent <agent@atlarix.dev>
---
 admin.go      |  2 +-
 admin_test.go | 22 ++++++++++++++++++++--
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/admin.go b/admin.go
index 5b079c9b2..da2470f3b 100644
--- a/admin.go
+++ b/admin.go
@@ -560,7 +560,7 @@ func replaceRemoteAdminServer(ctx Context, cfg *Config) error {
 					continue
 				}
 				cleanPath := path.Clean(permPath)
-				if cleanPath != permPath && strings.TrimRight(permPath, "/") != cleanPath {
+				if cleanPath != permPath && strings.TrimSuffix(permPath, "/") != cleanPath {
 					return fmt.Errorf("access control %d permission %d: path %q is not canonical (did you mean %q?)", i, j, permPath, cleanPath)
 				}
 			}
diff --git a/admin_test.go b/admin_test.go
index e4305a763..04c1aef6e 100644
--- a/admin_test.go
+++ b/admin_test.go
@@ -870,7 +870,7 @@ vq+SH04xKhtFudVBAQ==`
 			wantErr: true,
 		},
 		{
-			name: "non-canonical path //",
+			name: "root path with single trailing slash (//)",
 			cfg: &Config{
 				Admin: &AdminConfig{
 					Identity: &IdentityConfig{},
@@ -885,7 +885,7 @@ vq+SH04xKhtFudVBAQ==`
 					},
 				},
 			},
-			wantErr: true,
+			wantErr: false,
 		},
 		{
 			name: "non-canonical path /..",
@@ -923,6 +923,24 @@ vq+SH04xKhtFudVBAQ==`
 			},
 			wantErr: true,
 		},
+		{
+			name: "non-canonical path with double trailing slashes",
+			cfg: &Config{
+				Admin: &AdminConfig{
+					Identity: &IdentityConfig{},
+					Remote: &RemoteAdmin{
+						Listen: "localhost:2021",
+						AccessControl: []*AdminAccess{
+							{
+								PublicKeys:  []string{testCert},
+								Permissions: []AdminPermissions{{Methods: []string{"GET"}, Paths: []string{"/foo//"}}},
+							},
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
 	}
 
 	for _, test := range tests {