diff options
| author | Olivier Mengué <olivier.mengue@gmail.com> | 2025-07-25 10:34:34 +0200 |
|---|---|---|
| committer | Michael Matloob <matloob@golang.org> | 2026-03-19 14:10:45 -0700 |
| commit | 86b5e678e88efd89aee58e075064fd93c9346962 (patch) | |
| tree | 2b6c96306e8f7a574bbfa17091d92d9eaa59de84 /src | |
| parent | 59bafc0b0782a6984b0b79499861947d5ccce509 (diff) | |
| download | go-86b5e678e88efd89aee58e075064fd93c9346962.tar.xz | |
cmd/go: reject an empty tool name
An empty tool name ("") is incorrectly resolved by "go tool" as the directory
containing the tools binaries:
$ go tool ""
go tool : fork/exec /opt/homebrew/Cellar/go/1.24.5/libexec/pkg/tool/darwin_arm64: permission denied
To fix that case we also explicitely disallow an empty tool name in the
cmd/go/internal/base.ValidToolName func.
Tests: go test cmd/go -v '-run=Script/^tool_name$'
Fixes #74757.
Change-Id: I6dd14096526c9113cef8e4d16a5aaa2120410b08
Reviewed-on: https://go-review.googlesource.com/c/go/+/690435
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Michael Matloob <matloob@golang.org>
Reviewed-by: Michael Matloob <matloob@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/cmd/go/internal/base/tool.go | 3 | ||||
| -rw-r--r-- | src/cmd/go/testdata/script/tool_name.txt | 22 |
2 files changed, 25 insertions, 0 deletions
diff --git a/src/cmd/go/internal/base/tool.go b/src/cmd/go/internal/base/tool.go index f2fc0ff743..dc35ca2695 100644 --- a/src/cmd/go/internal/base/tool.go +++ b/src/cmd/go/internal/base/tool.go @@ -42,6 +42,9 @@ func ToolPath(toolName string) (string, error) { } func ValidToolName(toolName string) bool { + if toolName == "" { + return false + } for _, c := range toolName { switch { case 'a' <= c && c <= 'z', '0' <= c && c <= '9', c == '_': diff --git a/src/cmd/go/testdata/script/tool_name.txt b/src/cmd/go/testdata/script/tool_name.txt new file mode 100644 index 0000000000..d3f0f8cf5e --- /dev/null +++ b/src/cmd/go/testdata/script/tool_name.txt @@ -0,0 +1,22 @@ +[short] skip 'runs go build' + +# Tool name can't be empty. Issue #74757. +! go tool '' +stderr 'go: no such tool ""' + +! go tool -n '' +stderr 'go: no such tool ""' + +# Invalid tool name +! go tool @ +stderr 'go: no such tool "@"' + +! go tool -n @ +stderr 'go: no such tool "@"' + +-- go.mod -- +module example.com/foo + +go 1.24 +-- main.go -- +package main |