diff options
| author | Roland Shoemaker <bracewell@google.com> | 2025-06-09 11:23:46 -0700 |
|---|---|---|
| committer | Carlos Amedee <carlos@golang.org> | 2025-07-08 11:30:38 -0700 |
| commit | 54c9d776302d53ab1907645cb67fa4a948e1500c (patch) | |
| tree | 11915488ec36cdc3e5a2d6000b9a55e2d1d50e3c /src/runtime | |
| parent | fca43a8436f2dbec981fb002c6ba31fe9ff89dd6 (diff) | |
| download | go-54c9d776302d53ab1907645cb67fa4a948e1500c.tar.xz | |
cmd/go: disable support for multiple vcs in one module
Removes the somewhat redundant vcs.FromDir, "allowNesting" argument,
which was always enabled, and disallow multiple VCS metadata folders
being present in a single directory. This makes VCS injection attacks
much more difficult.
Also adds a GODEBUG, allowmultiplevcs, which re-enables this behavior.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting this issue.
Fixes #74380
Fixes CVE-2025-4674
Change-Id: I5787d90cdca8deb3aca6f154efb627df1e7d2789
Reviewed-on: https://go-review.googlesource.com/c/go/+/686515
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
Commit-Queue: Carlos Amedee <carlos@golang.org>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Diffstat (limited to 'src/runtime')
| -rw-r--r-- | src/runtime/metrics/doc.go | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/runtime/metrics/doc.go b/src/runtime/metrics/doc.go index 32fc436e1a..a1902bc6d7 100644 --- a/src/runtime/metrics/doc.go +++ b/src/runtime/metrics/doc.go @@ -230,6 +230,11 @@ Below is the full list of supported metrics, ordered lexicographically. /gc/stack/starting-size:bytes The stack size of new goroutines. + /godebug/non-default-behavior/allowmultiplevcs:events + The number of non-default behaviors executed by the cmd/go + package due to a non-default GODEBUG=allowmultiplevcs=... + setting. + /godebug/non-default-behavior/asynctimerchan:events The number of non-default behaviors executed by the time package due to a non-default GODEBUG=asynctimerchan=... setting. |