diff options
| author | Roland Shoemaker <roland@golang.org> | 2021-01-15 12:14:06 -0800 |
|---|---|---|
| committer | Roland Shoemaker <roland@golang.org> | 2021-01-21 19:10:18 +0000 |
| commit | 953d1feca9b21af075ad5fc8a3dad096d3ccc3a0 (patch) | |
| tree | 1ff369f7be4e70f816db745bc2b4cc465c9b4f96 /src/cmd/dist | |
| parent | b186e4d70de28697d1ad7e3c31625793e6338ef0 (diff) | |
| download | go-953d1feca9b21af075ad5fc8a3dad096d3ccc3a0.tar.xz | |
all: introduce and use internal/execabs
Introduces a wrapper around os/exec, internal/execabs, for use in
all commands. This wrapper prevents exec.LookPath and exec.Command from
running executables in the current directory.
All imports of os/exec in non-test files in cmd/ are replaced with
imports of internal/execabs.
This issue was reported by RyotaK.
Fixes CVE-2021-3115
Fixes #43783
Change-Id: I0423451a6e27ec1e1d6f3fe929ab1ef69145c08f
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/955304
Reviewed-by: Russ Cox <rsc@google.com>
Reviewed-by: Katie Hockman <katiehockman@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/284783
Run-TryBot: Roland Shoemaker <roland@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
Trust: Roland Shoemaker <roland@golang.org>
Diffstat (limited to 'src/cmd/dist')
| -rw-r--r-- | src/cmd/dist/buildtool.go | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/cmd/dist/buildtool.go b/src/cmd/dist/buildtool.go index e7bedfb84e..cf85f2ac8e 100644 --- a/src/cmd/dist/buildtool.go +++ b/src/cmd/dist/buildtool.go @@ -305,8 +305,10 @@ func bootstrapFixImports(srcFile string) string { continue } if strings.HasPrefix(line, `import "`) || strings.HasPrefix(line, `import . "`) || - inBlock && (strings.HasPrefix(line, "\t\"") || strings.HasPrefix(line, "\t. \"")) { + inBlock && (strings.HasPrefix(line, "\t\"") || strings.HasPrefix(line, "\t. \"") || strings.HasPrefix(line, "\texec \"")) { line = strings.Replace(line, `"cmd/`, `"bootstrap/cmd/`, -1) + // During bootstrap, must use plain os/exec. + line = strings.Replace(line, `exec "internal/execabs"`, `"os/exec"`, -1) for _, dir := range bootstrapDirs { if strings.HasPrefix(dir, "cmd/") { continue |