From 2aa62e3d9062cfbbb417fd728bf94fa5d67e14ea Mon Sep 17 00:00:00 2001
From: Sean Liao <sean@liao.dev>
Date: Fri, 17 Apr 2026 19:01:36 +0100
Subject: [PATCH] cmd/go/internal/list: disallow empty string arg

Fixes #37300

Change-Id: I2b2c480f8224fff5a72d1f5a9c3c4c686a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/768360
Reviewed-by: Carlos Amedee <carlos@golang.org>
Reviewed-by: Michael Matloob <matloob@google.com>
Reviewed-by: Michael Matloob <matloob@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
---
 src/cmd/go/internal/list/list.go                 | 6 ++++++
 src/cmd/go/testdata/script/list_empty_import.txt | 5 +++++
 2 files changed, 11 insertions(+)

diff --git a/src/cmd/go/internal/list/list.go b/src/cmd/go/internal/list/list.go
index 31dcc206aa..66a51c5e4f 100644
--- a/src/cmd/go/internal/list/list.go
+++ b/src/cmd/go/internal/list/list.go
@@ -419,6 +419,12 @@ func (v *jsonFlag) needAny(fields ...string) bool {
 var nl = []byte{'\n'}
 
 func runList(ctx context.Context, cmd *base.Command, args []string) {
+	for _, arg := range args {
+		if arg == "" {
+			base.Fatalf("go: invalid package: %q", arg)
+		}
+	}
+
 	moduleLoader := modload.NewLoader()
 	moduleLoader.InitWorkfile()
 
diff --git a/src/cmd/go/testdata/script/list_empty_import.txt b/src/cmd/go/testdata/script/list_empty_import.txt
index 4d76f098b9..2a18107b67 100644
--- a/src/cmd/go/testdata/script/list_empty_import.txt
+++ b/src/cmd/go/testdata/script/list_empty_import.txt
@@ -3,6 +3,11 @@
 stderr 'invalid import path'
 ! stderr panic
 
+! go list ''
+stderr 'invalid package'
+! go list -m ''
+stderr 'invalid package'
+
 -- a.go --
 package a