diff options
| author | Roland Shoemaker <bracewell@google.com> | 2025-06-09 11:23:46 -0700 |
|---|---|---|
| committer | Carlos Amedee <carlos@golang.org> | 2025-07-08 11:30:38 -0700 |
| commit | 54c9d776302d53ab1907645cb67fa4a948e1500c (patch) | |
| tree | 11915488ec36cdc3e5a2d6000b9a55e2d1d50e3c /src/internal/godebugs/table.go | |
| parent | fca43a8436f2dbec981fb002c6ba31fe9ff89dd6 (diff) | |
| download | go-54c9d776302d53ab1907645cb67fa4a948e1500c.tar.xz | |
cmd/go: disable support for multiple vcs in one module
Removes the somewhat redundant vcs.FromDir, "allowNesting" argument,
which was always enabled, and disallow multiple VCS metadata folders
being present in a single directory. This makes VCS injection attacks
much more difficult.
Also adds a GODEBUG, allowmultiplevcs, which re-enables this behavior.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting this issue.
Fixes #74380
Fixes CVE-2025-4674
Change-Id: I5787d90cdca8deb3aca6f154efb627df1e7d2789
Reviewed-on: https://go-review.googlesource.com/c/go/+/686515
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
Commit-Queue: Carlos Amedee <carlos@golang.org>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Diffstat (limited to 'src/internal/godebugs/table.go')
| -rw-r--r-- | src/internal/godebugs/table.go | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/internal/godebugs/table.go b/src/internal/godebugs/table.go index 38dc7b0fac..2d00882545 100644 --- a/src/internal/godebugs/table.go +++ b/src/internal/godebugs/table.go @@ -26,6 +26,7 @@ type Info struct { // Note: After adding entries to this table, update the list in doc/godebug.md as well. // (Otherwise the test in this package will fail.) var All = []Info{ + {Name: "allowmultiplevcs", Package: "cmd/go"}, {Name: "asynctimerchan", Package: "time", Changed: 23, Old: "1"}, {Name: "containermaxprocs", Package: "runtime", Changed: 25, Old: "0"}, {Name: "dataindependenttiming", Package: "crypto/subtle", Opaque: true}, |