From: Hetvi Thakar <[email protected]> This patch applies the upstream fix as referenced in [2], using the commit shown in [1].
[1] https://github.com/golang/go/commit/f0384f7c664892ed3ee8c0fec68638d9b3b01811 [2] https://pkg.go.dev/vuln/GO-2026-4982 Signed-off-by: Hetvi Thakar <[email protected]> Signed-off-by: Yoann Congal <[email protected]> --- meta/recipes-devtools/go/go-1.22.12.inc | 1 + .../go/go/CVE-2026-39823.patch | 100 ++++++++++++++++++ 2 files changed, 101 insertions(+) create mode 100644 meta/recipes-devtools/go/go/CVE-2026-39823.patch diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc index ee2f5ca2777..a2c0efa3781 100644 --- a/meta/recipes-devtools/go/go-1.22.12.inc +++ b/meta/recipes-devtools/go/go-1.22.12.inc @@ -63,6 +63,7 @@ SRC_URI += "\ file://CVE-2026-32288.patch \ file://CVE-2026-27145.patch \ file://CVE-2026-33814.patch \ + file://CVE-2026-39823.patch \ " SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71" diff --git a/meta/recipes-devtools/go/go/CVE-2026-39823.patch b/meta/recipes-devtools/go/go/CVE-2026-39823.patch new file mode 100644 index 00000000000..00e25bb35c6 --- /dev/null +++ b/meta/recipes-devtools/go/go/CVE-2026-39823.patch @@ -0,0 +1,100 @@ +From 4915efb53a017a136a233a7676e80858d5b6e560 Mon Sep 17 00:00:00 2001 +From: Neal Patel <[email protected]> +Date: Wed, 22 Apr 2026 18:41:25 -0400 +Subject: [PATCH] [release-branch.go1.25] html/template: fix escaping of URLs + in meta content attributes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The WHATWG "shared declarative refresh steps" algorithm (ยง4.2.5.3) +skips ASCII whitespace between "url" and "=" when parsing the URL +portion of a meta content attribute. + +Thank you to Samy Ghannad for reporting this issue. + +Updates #78913 +Fixes #79031 +Fixes CVE-2026-39823 + +Change-Id: I7fc3bb9394b95e07b9b10fbc95725a3de6791774 +Reviewed-on: https://go-review.googlesource.com/c/go/+/769920 +Reviewed-by: Roland Shoemaker <[email protected]> +TryBot-Bypass: Roland Shoemaker <[email protected]> +(cherry picked from commit f2ec1254ff32fa39f3ce4faf72bbe44eeeeebad9) +Reviewed-on: https://go-review.googlesource.com/c/go/+/772101 +LUCI-TryBot-Result: [email protected] <[email protected]> + +CVE: CVE-2026-39823 +Upstream-Status: Backport [https://github.com/golang/go/commit/f0384f7c664892ed3ee8c0fec68638d9b3b01811] + +(cherry picked from commit f0384f7c664892ed3ee8c0fec68638d9b3b01811) +Signed-off-by: Hetvi Thakar <[email protected]> +--- + src/html/template/escape_test.go | 20 ++++++++++++++++++++ + src/html/template/transition.go | 12 +++++++----- + 2 files changed, 27 insertions(+), 5 deletions(-) + +diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go +index ce064407384..c9e566a9076 100644 +--- a/src/html/template/escape_test.go ++++ b/src/html/template/escape_test.go +@@ -759,6 +759,26 @@ func TestEscape(t *testing.T) { + `<meta http-equiv="refresh" content="{{"asd: 123"}}">`, + `<meta http-equiv="refresh" content="asd: 123">`, + }, ++ { ++ "meta content url with whitespace before equals", ++ `<meta http-equiv="refresh" content="0;url ={{"javascript:alert(1)"}}">`, ++ `<meta http-equiv="refresh" content="0;url =#ZgotmplZ">`, ++ }, ++ { ++ "meta content url with tab before equals", ++ "<meta http-equiv=\"refresh\" content=\"0;url\t={{\"javascript:alert(1)\"}}\">", ++ "<meta http-equiv=\"refresh\" content=\"0;url\t=#ZgotmplZ\">", ++ }, ++ { ++ "meta content url with space after equals", ++ `<meta http-equiv="refresh" content="0;url= {{"javascript:alert(1)"}}">`, ++ `<meta http-equiv="refresh" content="0;url= #ZgotmplZ">`, ++ }, ++ { ++ "meta content url with whitespace both sides of equals", ++ "<meta http-equiv=\"refresh\" content=\"0;url \t= {{\"javascript:alert(1)\"}}\">", ++ "<meta http-equiv=\"refresh\" content=\"0;url \t= #ZgotmplZ\">", ++ }, + } + + for _, test := range tests { +diff --git a/src/html/template/transition.go b/src/html/template/transition.go +index 5aa3c35440b..ac05d56b418 100644 +--- a/src/html/template/transition.go ++++ b/src/html/template/transition.go +@@ -626,10 +626,12 @@ func tError(c context, s []byte) (context, int) { + + // tMetaContent is the context transition function for the meta content attribute state. + func tMetaContent(c context, s []byte) (context, int) { +- for i := 0; i < len(s); i++ { +- if i+3 <= len(s)-1 && bytes.Equal(bytes.ToLower(s[i:i+4]), []byte("url=")) { +- c.state = stateMetaContentURL +- return c, i + 4 ++ for i := range len(s) { ++ if i+3 <= len(s)-1 && bytes.EqualFold(s[i:i+3], []byte("url")) { ++ if j := eatWhiteSpace(s, i+3); j < len(s) && s[j] == '=' { ++ c.state = stateMetaContentURL ++ return c, j + 1 ++ } + } + } + return c, len(s) +@@ -637,7 +639,7 @@ func tMetaContent(c context, s []byte) (context, int) { + + // tMetaContentURL is the context transition function for the "url=" part of a meta content attribute state. + func tMetaContentURL(c context, s []byte) (context, int) { +- for i := 0; i < len(s); i++ { ++ for i := range len(s) { + if s[i] == ';' { + c.state = stateMetaContent + return c, i + 1 +-- +2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245676): https://lists.openembedded.org/g/openembedded-core/message/245676 Mute This Topic: https://lists.openembedded.org/mt/121207010/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
