Merge pull request #13634 from mattfarina/cleanup-securejoin-v3

Ensuring the file paths are clean prior to passing to securejoin (v3 backport)

pkg/chartutil/expand.go

@@ -52,6 +52,9 @@ func Expand(dir string, r io.Reader) error {
 	}
 
 	// Find the base directory
+	// The directory needs to be cleaned prior to passing to SecureJoin or the location may end up
+	// being wrong or returning an error. This was introduced in v0.4.0.
+	dir = filepath.Clean(dir)
 	chartdir, err := securejoin.SecureJoin(dir, chartName)
 	if err != nil {
 		return err

pkg/plugin/installer/http_installer.go

@@ -206,6 +206,9 @@ func cleanJoin(root, dest string) (string, error) {
 	}
 
 	// SecureJoin will do some cleaning, as well as some rudimentary checking of symlinks.
+	// The directory needs to be cleaned prior to passing to SecureJoin or the location may end up
+	// being wrong or returning an error. This was introduced in v0.4.0.
+	root = filepath.Clean(root)
 	newpath, err := securejoin.SecureJoin(root, dest)
 	if err != nil {
 		return "", err