From 953d1feca9b21af075ad5fc8a3dad096d3ccc3a0 Mon Sep 17 00:00:00 2001 From: Roland Shoemaker Date: Fri, 15 Jan 2021 12:14:06 -0800 Subject: all: introduce and use internal/execabs Introduces a wrapper around os/exec, internal/execabs, for use in all commands. This wrapper prevents exec.LookPath and exec.Command from running executables in the current directory. All imports of os/exec in non-test files in cmd/ are replaced with imports of internal/execabs. This issue was reported by RyotaK. Fixes CVE-2021-3115 Fixes #43783 Change-Id: I0423451a6e27ec1e1d6f3fe929ab1ef69145c08f Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/955304 Reviewed-by: Russ Cox Reviewed-by: Katie Hockman Reviewed-on: https://go-review.googlesource.com/c/go/+/284783 Run-TryBot: Roland Shoemaker Reviewed-by: Katie Hockman Trust: Roland Shoemaker --- src/cmd/api/goapi.go | 2 +- src/cmd/api/run.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'src/cmd/api') diff --git a/src/cmd/api/goapi.go b/src/cmd/api/goapi.go index ba42812fa6..efc2696f8f 100644 --- a/src/cmd/api/goapi.go +++ b/src/cmd/api/goapi.go @@ -16,10 +16,10 @@ import ( "go/parser" "go/token" "go/types" + exec "internal/execabs" "io" "log" "os" - "os/exec" "path/filepath" "regexp" "runtime" diff --git a/src/cmd/api/run.go b/src/cmd/api/run.go index a36f1179c1..ecb1d0f81a 100644 --- a/src/cmd/api/run.go +++ b/src/cmd/api/run.go @@ -10,9 +10,9 @@ package main import ( "fmt" + exec "internal/execabs" "log" "os" - "os/exec" "path/filepath" "runtime" "strings" -- cgit v1.3