diff options
| author | Roland Shoemaker <bracewell@google.com> | 2025-06-09 11:23:46 -0700 |
|---|---|---|
| committer | Carlos Amedee <carlos@golang.org> | 2025-07-08 11:30:38 -0700 |
| commit | 54c9d776302d53ab1907645cb67fa4a948e1500c (patch) | |
| tree | 11915488ec36cdc3e5a2d6000b9a55e2d1d50e3c /doc/godebug.md | |
| parent | fca43a8436f2dbec981fb002c6ba31fe9ff89dd6 (diff) | |
| download | go-54c9d776302d53ab1907645cb67fa4a948e1500c.tar.xz | |
cmd/go: disable support for multiple vcs in one module
Removes the somewhat redundant vcs.FromDir, "allowNesting" argument,
which was always enabled, and disallow multiple VCS metadata folders
being present in a single directory. This makes VCS injection attacks
much more difficult.
Also adds a GODEBUG, allowmultiplevcs, which re-enables this behavior.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting this issue.
Fixes #74380
Fixes CVE-2025-4674
Change-Id: I5787d90cdca8deb3aca6f154efb627df1e7d2789
Reviewed-on: https://go-review.googlesource.com/c/go/+/686515
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
Commit-Queue: Carlos Amedee <carlos@golang.org>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Diffstat (limited to 'doc/godebug.md')
| -rw-r--r-- | doc/godebug.md | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/doc/godebug.md b/doc/godebug.md index d107b1baf1..aaa0f9dd55 100644 --- a/doc/godebug.md +++ b/doc/godebug.md @@ -189,6 +189,11 @@ crypto/x509.CreateCertificate. The setting `x509sha256skid=0` reverts to SHA-1. Go 1.25 corrected the semantics of contention reports for runtime-internal locks, and so removed the [`runtimecontentionstacks` setting](/pkg/runtime#hdr-Environment_Variables). +Go 1.25 (starting with Go 1.25 RC 2) disabled build information stamping when +multiple VCS are detected due to concerns around VCS injection attacks. This +behavior and setting was backported to Go 1.24.5 and Go 1.23.11. This behavior +can be renabled with the setting `allowmultiplevcs=1`. + ### Go 1.24 Go 1.24 added a new `fips140` setting that controls whether the Go |