Stowage/go
2
0
Fork 0
mirror of https://github.com/golang/go.git synced 2025-12-08 06:10:04 +00:00
Code Issues Projects Releases Packages Wiki Activity

all: introduce and use internal/execabs

Browse source 
Introduces a wrapper around os/exec, internal/execabs, for use in
all commands. This wrapper prevents exec.LookPath and exec.Command from
running executables in the current directory.

All imports of os/exec in non-test files in cmd/ are replaced with
imports of internal/execabs.

This issue was reported by RyotaK.

Fixes CVE-2021-3115
Fixes #43783

Change-Id: I0423451a6e27ec1e1d6f3fe929ab1ef69145c08f
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/955304
Reviewed-by: Russ Cox <rsc@google.com>
Reviewed-by: Katie Hockman <katiehockman@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/284783
Run-TryBot: Roland Shoemaker <roland@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
Trust: Roland Shoemaker <roland@golang.org>
This commit is contained in:
Roland Shoemaker 2021-01-15 12:14:06 -08:00
parent b186e4d70d
commit 953d1feca9
40 changed files with 220 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/cmd/cgo/out.go
View file

@ -14,10 +14,10 @@ import (
"go/ast"
"go/printer"
"go/token"
exec "internal/execabs"
"internal/xcoff"
"io"
"os"
"os/exec"
"path/filepath"
"regexp"
"sort"