mirror of https://github.com/golang/go.git
953d1feca9
Introduces a wrapper around os/exec, internal/execabs, for use in all commands. This wrapper prevents exec.LookPath and exec.Command from running executables in the current directory. All imports of os/exec in non-test files in cmd/ are replaced with imports of internal/execabs. This issue was reported by RyotaK. Fixes CVE-2021-3115 Fixes #43783 Change-Id: I0423451a6e27ec1e1d6f3fe929ab1ef69145c08f Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/955304 Reviewed-by: Russ Cox <rsc@google.com> Reviewed-by: Katie Hockman <katiehockman@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/284783 Run-TryBot: Roland Shoemaker <roland@golang.org> Reviewed-by: Katie Hockman <katie@golang.org> Trust: Roland Shoemaker <roland@golang.org> |
||
|---|---|---|
| .. | ||
| cftype.go | ||
| cftype_test.go | ||
| context.go | ||
| context_test.go | ||
| doc.go | ||
| egltype.go | ||
| egltype_test.go | ||
| fix.go | ||
| gotypes.go | ||
| gotypes_test.go | ||
| import_test.go | ||
| jnitype.go | ||
| jnitype_test.go | ||
| main.go | ||
| main_test.go | ||
| netipv6zone.go | ||
| netipv6zone_test.go | ||
| printerconfig.go | ||
| printerconfig_test.go | ||
| typecheck.go | ||