2 Commits

Author	SHA1	Message	Date
Roland Shoemaker	94200a92cf	[release-branch.go1.14-security] all: introduce and use internal/execabs ... Introduces a wrapper around os/exec, internal/execabs, for use in all commands. This wrapper prevents exec.LookPath and exec.Command from running executables in the current directory. All imports of os/exec in non-test files in cmd/ are replaced with imports of internal/execabs. This issue was reported by RyotaK. Fixes CVE-2021-3115 Change-Id: I0423451a6e27ec1e1d6f3fe929ab1ef69145c08f Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/955304 Reviewed-by: Russ Cox <rsc@google.com> Reviewed-by: Katie Hockman <katiehockman@google.com> (cherry picked from commit 44f09a6990ccf4db601cbf8208c89ac4e888f884) Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/955309	2021-01-15 17:44:08 -08:00
Mikhail Fesenko	fd1e60f6e3	cmd/fix, cmd/go, cmd/gofmt: refactor common code into new internal diff package ... Change-Id: Idac8473d1752059bf2f617fd7a781000ee2c3af4 GitHub-Last-Rev: 02a3aa1a32 GitHub-Pull-Request: golang/go#35141 Reviewed-on: https://go-review.googlesource.com/c/go/+/203218 Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>	2019-10-28 23:59:10 +00:00