From: Deepak Rathore <[email protected]> Upstream Repository: https://github.com/golang/go.git
Bug details: https://nvd.nist.gov/vuln/detail/CVE-2025-68119 Type: Security Fix CVE: CVE-2025-68119 Score: 7.0 Patch: [1] https://github.com/golang/go/commit/62452bed4801 [2] https://github.com/golang/go/commit/73fe85f0ea1b Note: - First commit [1] is a dependent patch which is required additionally in original fix [2] to define ENV variable changes in src/cmd/go/internal/vcs/vcs.go file. Signed-off-by: Deepak Rathore <[email protected]> diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc index 82019f25dd..ca0f05f7c8 100644 --- a/meta/recipes-devtools/go/go-1.22.12.inc +++ b/meta/recipes-devtools/go/go-1.22.12.inc @@ -35,6 +35,8 @@ SRC_URI += "\ file://CVE-2025-61726.patch \ file://CVE-2025-61728.patch \ file://CVE-2025-61731.patch \ + file://CVE-2025-68119-dependent.patch \ + file://CVE-2025-68119.patch \ " SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71" diff --git a/meta/recipes-devtools/go/go/CVE-2025-68119-dependent.patch b/meta/recipes-devtools/go/go/CVE-2025-68119-dependent.patch new file mode 100644 index 0000000000..5875d129cc --- /dev/null +++ b/meta/recipes-devtools/go/go/CVE-2025-68119-dependent.patch @@ -0,0 +1,175 @@ +From 121b6cb231b5d904c03739495fcda69152d83f88 Mon Sep 17 00:00:00 2001 +From: Matt Harbison <[email protected]> +Date: Sat, 3 Aug 2024 00:06:30 +0000 +Subject: [PATCH] cmd/go: fix the accuracy of Mercurial vcs.* stamped data + +There were a few Mercurial command line uses that could cause the wrong +data to be used: + +* The log command needs '-r.' to specify the currently checked out commit +* HGPLAIN is needed to disable optional output on commands +* '-S' is needed to for the 'status' command to recurse into any subrepos + +The most likely issue to be seen here was the use of '-l1' instead of +'-r.', which prints the most recent commit instead of the current checkout. +Since tagging in Mercurial creates a new commit, this basically means the +data was wrong for every tagged build. + +This also adds an hgrc config file to the test, with config options to +keep the time and author values fixed. It's what's used in the Mercurial +test harness to keep the commit hashes stable, and allows the tests here to +also match the time and the revision ID, to prevent regressing. + +Fixes #63532 + +CVE: CVE-2025-68119 +Upstream-Status: Backport [https://github.com/golang/go/commit/62452bed4801] + +Change-Id: I5b9971ce87c83431ec77e4a002bdc33fcf393856 +GitHub-Last-Rev: 62c9db0a28fee5881d0fe49f7bbb6e1653c7ff60 +GitHub-Pull-Request: golang/go#63557 +Reviewed-on: https://go-review.googlesource.com/c/go/+/535377 +Reviewed-by: Bryan Mills <[email protected]> +LUCI-TryBot-Result: Go LUCI <[email protected]> +Reviewed-by: Sam Thanawalla <[email protected]> +Auto-Submit: Sam Thanawalla <[email protected]> +Reviewed-by: Michael Matloob <[email protected]> +(cherry picked from commit 62452bed480108623910feace4a5cea5448e6822) +Signed-off-by: Deepak Rathore <[email protected]> +--- + src/cmd/go/internal/vcs/vcs.go | 13 +++++-- + .../testdata/script/version_buildvcs_hg.txt | 39 ++++++++++++++++--- + 2 files changed, 43 insertions(+), 9 deletions(-) + +diff --git a/src/cmd/go/internal/vcs/vcs.go b/src/cmd/go/internal/vcs/vcs.go +index 89d9f0e94e..60f76d77cf 100644 +--- a/src/cmd/go/internal/vcs/vcs.go ++++ b/src/cmd/go/internal/vcs/vcs.go +@@ -37,6 +37,7 @@ import ( + type Cmd struct { + Name string + Cmd string // name of binary to invoke command ++ Env []string // any environment values to set/override + RootNames []rootName // filename and mode indicating the root of a checkout directory + + CreateCmd []string // commands to download a fresh copy of a repository +@@ -154,6 +155,10 @@ func vcsByCmd(cmd string) *Cmd { + var vcsHg = &Cmd{ + Name: "Mercurial", + Cmd: "hg", ++ ++ // HGPLAIN=1 turns off additional output that a user may have enabled via ++ // config options or certain extensions. ++ Env: []string{"HGPLAIN=1"}, + RootNames: []rootName{ + {filename: ".hg", isDir: true}, + }, +@@ -189,12 +194,11 @@ func hgRemoteRepo(vcsHg *Cmd, rootDir string) (remoteRepo string, err error) { + + func hgStatus(vcsHg *Cmd, rootDir string) (Status, error) { + // Output changeset ID and seconds since epoch. +- out, err := vcsHg.runOutputVerboseOnly(rootDir, `log -l1 -T {node}:{date|hgdate}`) ++ out, err := vcsHg.runOutputVerboseOnly(rootDir, `log -r. -T {node}:{date|hgdate}`) + if err != nil { + return Status{}, err + } + +- // Successful execution without output indicates an empty repo (no commits). + var rev string + var commitTime time.Time + if len(out) > 0 { +@@ -209,7 +213,7 @@ func hgStatus(vcsHg *Cmd, rootDir string) (Status, error) { + } + + // Also look for untracked files. +- out, err = vcsHg.runOutputVerboseOnly(rootDir, "status") ++ out, err = vcsHg.runOutputVerboseOnly(rootDir, "status -S") + if err != nil { + return Status{}, err + } +@@ -689,6 +693,9 @@ func (v *Cmd) run1(dir string, cmdline string, keyval []string, verbose bool) ([ + + cmd := exec.Command(v.Cmd, args...) + cmd.Dir = dir ++ if v.Env != nil { ++ cmd.Env = append(cmd.Environ(), v.Env...) ++ } + if cfg.BuildX { + fmt.Fprintf(os.Stderr, "cd %s\n", dir) + fmt.Fprintf(os.Stderr, "%s %s\n", v.Cmd, strings.Join(args, " ")) +diff --git a/src/cmd/go/testdata/script/version_buildvcs_hg.txt b/src/cmd/go/testdata/script/version_buildvcs_hg.txt +index fbbd886102..13904fae12 100644 +--- a/src/cmd/go/testdata/script/version_buildvcs_hg.txt ++++ b/src/cmd/go/testdata/script/version_buildvcs_hg.txt +@@ -6,6 +6,8 @@ + [short] skip + env GOBIN=$WORK/gopath/bin + env oldpath=$PATH ++env TZ=GMT ++env HGRCPATH=$WORK/hgrc + cd repo/a + + # If there's no local repository, there's no VCS info. +@@ -29,24 +31,43 @@ cd .. + env PATH=$oldpath + rm .hg + +-# If there is an empty repository in a parent directory, only "uncommitted" is tagged. ++# An empty repository or one explicitly updated to null uses the null cset ID, ++# and the time is hard set to 1/1/70, regardless of the current time. + exec hg init + cd a + go install + go version -m $GOBIN/a$GOEXE +-! stdout vcs.revision +-! stdout vcs.time ++stdout '^\tbuild\tvcs.revision=0000000000000000000000000000000000000000$' ++stdout '^\tbuild\tvcs.time=1970-01-01T00:00:00Z$' + stdout '^\tbuild\tvcs.modified=true$' + cd .. + + # Revision and commit time are tagged for repositories with commits. + exec hg add a README +-exec hg commit -m 'initial commit' ++exec hg commit -m 'initial commit' --user test-user --date '2024-07-31T01:21:27+00:00' + cd a + go install + go version -m $GOBIN/a$GOEXE +-stdout '^\tbuild\tvcs.revision=' +-stdout '^\tbuild\tvcs.time=' ++stdout '^\tbuild\tvcs.revision=71eaed52daeaafea83cb604f75b0a0336ef2c345$' ++stdout '^\tbuild\tvcs.time=2024-07-31T01:21:27Z$' ++stdout '^\tbuild\tvcs.modified=false$' ++rm $GOBIN/a$GOEXE ++ ++# Add an extra commit and then back off of it to show that the hash is ++# from the checked out revision, not the tip revision. ++cp ../../outside/empty.txt . ++exec hg ci -Am 'another commit' --user test-user --date '2024-08-01T19:24:38+00:00' ++exec hg update --clean -r '.^' ++ ++# Modified state is not thrown off by extra status output ++exec hg bisect -v -g . ++exec hg bisect -v -b '.^^' ++exec hg status ++stdout '^.+' ++go install ++go version -m $GOBIN/a$GOEXE ++stdout '^\tbuild\tvcs.revision=71eaed52daeaafea83cb604f75b0a0336ef2c345$' ++stdout '^\tbuild\tvcs.time=2024-07-31T01:21:27Z$' + stdout '^\tbuild\tvcs.modified=false$' + rm $GOBIN/a$GOEXE + +@@ -88,4 +109,10 @@ go 1.18 + package main + + func main() {} ++-- $WORK/hgrc -- ++[ui] ++# tweakdefaults is an opt-in that may print extra output in commands like ++# status. That can be disabled by setting HGPLAIN=1. ++tweakdefaults = 1 ++ + -- outside/empty.txt -- +-- +2.35.6 diff --git a/meta/recipes-devtools/go/go/CVE-2025-68119.patch b/meta/recipes-devtools/go/go/CVE-2025-68119.patch new file mode 100644 index 0000000000..d3f1724453 --- /dev/null +++ b/meta/recipes-devtools/go/go/CVE-2025-68119.patch @@ -0,0 +1,828 @@ +From 204e2fdacfbdb72a0b85fb526c8599128e430e94 Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <[email protected]> +Date: Wed, 10 Dec 2025 08:13:07 -0500 +Subject: [PATCH] [release-branch.go1.24] cmd/go: update VCS commands to use + safer flag/argument syntax + +In various situations, the toolchain invokes VCS commands. Some of these +commands take arbitrary input, either provided by users or fetched from +external sources. To prevent potential command injection vulnerabilities +or misinterpretation of arguments as flags, this change updates the VCS +commands to use various techniques to separate flags from positional +arguments, and to directly associate flags with their values. + +Additionally, we update the environment variable for Mercurial to use +`HGPLAIN=+strictflags`, which is the more explicit way to disable user +configurations (intended or otherwise) that might interfere with command +execution. + +We also now disallow version strings from being prefixed with '-' or +'/', as doing so opens us up to making the same mistake again in the +future. As far as we know there are currently ~0 public modules affected +by this. + +While I was working on cmd/go/internal/vcs, I also noticed that a +significant portion of the commands being implemented were dead code. +In order to reduce the maintenance burden and surface area for potential +issues, I removed the dead code for unused commands. + +We should probably follow up with a more structured change to make it +harder to accidentally re-introduce these issues in the future, but for +now this addresses the issue at hand. + +Thanks to splitline (@splitline) from DEVCORE Research Team for +reporting this issue. + +Fixes CVE-2025-68119 +Updates #77099 +Fixes #77103 + +CVE: CVE-2025-68119 +Upstream-Status: Backport [https://github.com/golang/go/commit/73fe85f0ea1b] + +Backport Changes: +- In file src/cmd/go/internal/modfetch/codehost/git.go, Replaced the + function call runGIT with RUN. This changes is not present in current + version v1.22.12 and this changes were introduced in version v1.24 by + this commit https://github.com/golang/go/commit/8aa2eed8fb90 + +Change-Id: I9d9f4ee05b95be49fe14edf71a1b8e6c0784378e +Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3260 +Reviewed-by: Damien Neil <[email protected]> +Reviewed-by: Nicholas Husin <[email protected]> +Reviewed-on: https://go-review.googlesource.com/c/go/+/736710 +Auto-Submit: Michael Pratt <[email protected]> +Reviewed-by: Junyang Shao <[email protected]> +LUCI-TryBot-Result: Go LUCI <[email protected]> +(cherry picked from commit 94a1296a457387d1fd6eca1a9bcd44e89bdd9d55) +Reviewed-on: https://go-review.googlesource.com/c/go/+/739421 +Auto-Submit: Dmitri Shuralyov <[email protected]> +(cherry picked from commit 73fe85f0ea1bf2cec8e9a89bf5645de06ecaa0a6) +Signed-off-by: Deepak Rathore <[email protected]> +--- + src/cmd/go/internal/modcmd/edit.go | 10 +- + src/cmd/go/internal/modfetch/codehost/git.go | 20 +- + src/cmd/go/internal/modfetch/codehost/vcs.go | 20 +- + src/cmd/go/internal/modget/query.go | 5 +- + src/cmd/go/internal/modload/build.go | 12 +- + src/cmd/go/internal/modload/list.go | 30 +- + src/cmd/go/internal/toolchain/select.go | 7 +- + src/cmd/go/internal/vcs/vcs.go | 331 +------------------ + src/cmd/go/internal/workcmd/edit.go | 5 +- + 9 files changed, 96 insertions(+), 344 deletions(-) + +diff --git a/src/cmd/go/internal/modcmd/edit.go b/src/cmd/go/internal/modcmd/edit.go +index db131b0881..330603fe32 100644 +--- a/src/cmd/go/internal/modcmd/edit.go ++++ b/src/cmd/go/internal/modcmd/edit.go +@@ -284,7 +284,10 @@ func runEdit(ctx context.Context, cmd *base.Command, args []string) { + + // parsePathVersion parses -flag=arg expecting arg to be path@version. + func parsePathVersion(flag, arg string) (path, version string) { +- before, after, found := strings.Cut(arg, "@") ++ before, after, found, err := modload.ParsePathVersion(arg) ++ if err != nil { ++ base.Fatalf("go: -%s=%s: %v", flag, arg, err) ++ } + if !found { + base.Fatalf("go: -%s=%s: need path@version", flag, arg) + } +@@ -318,7 +321,10 @@ func parsePathVersionOptional(adj, arg string, allowDirPath bool) (path, version + if allowDirPath && modfile.IsDirectoryPath(arg) { + return arg, "", nil + } +- before, after, found := strings.Cut(arg, "@") ++ before, after, found, err := modload.ParsePathVersion(arg) ++ if err != nil { ++ return "", "", err ++ } + if !found { + path = arg + } else { +diff --git a/src/cmd/go/internal/modfetch/codehost/git.go b/src/cmd/go/internal/modfetch/codehost/git.go +index 9996be7af7..45727ae3fb 100644 +--- a/src/cmd/go/internal/modfetch/codehost/git.go ++++ b/src/cmd/go/internal/modfetch/codehost/git.go +@@ -246,7 +246,7 @@ func (r *gitRepo) loadRefs(ctx context.Context) (map[string]string, error) { + r.refsErr = err + return + } +- out, gitErr := Run(ctx, r.dir, "git", "ls-remote", "-q", r.remote) ++ out, gitErr := Run(ctx, r.dir, "git", "ls-remote", "-q","--end-of-options", r.remote) + release() + + if gitErr != nil { +@@ -509,7 +509,7 @@ func (r *gitRepo) stat(ctx context.Context, rev string) (info *RevInfo, err erro + if fromTag && !slices.Contains(info.Tags, tag) { + // The local repo includes the commit hash we want, but it is missing + // the corresponding tag. Add that tag and try again. +- _, err := Run(ctx, r.dir, "git", "tag", tag, hash) ++ _, err := Run(ctx, r.dir, "git", "tag","--end-of-options", tag, hash) + if err != nil { + return nil, err + } +@@ -554,7 +554,7 @@ func (r *gitRepo) stat(ctx context.Context, rev string) (info *RevInfo, err erro + // an apparent Git bug introduced in Git 2.21 (commit 61c771), + // which causes the handler for protocol version 1 to sometimes miss + // tags that point to the requested commit (see https://go.dev/issue/56881). +- _, err = Run(ctx, r.dir, "git", "-c", "protocol.version=2", "fetch", "-f", "--depth=1", r.remote, refspec) ++ _, err = Run(ctx, r.dir, "git", "-c", "protocol.version=2", "fetch", "-f", "--depth=1","--end-of-options", r.remote, refspec) + release() + + if err == nil { +@@ -597,12 +597,12 @@ func (r *gitRepo) fetchRefsLocked(ctx context.Context) error { + } + defer release() + +- if _, err := Run(ctx, r.dir, "git", "fetch", "-f", r.remote, "refs/heads/*:refs/heads/*", "refs/tags/*:refs/tags/*"); err != nil { ++ if _, err := Run(ctx, r.dir, "git", "fetch", "-f","--end-of-options", r.remote, "refs/heads/*:refs/heads/*", "refs/tags/*:refs/tags/*"); err != nil { + return err + } + + if _, err := os.Stat(filepath.Join(r.dir, "shallow")); err == nil { +- if _, err := Run(ctx, r.dir, "git", "fetch", "--unshallow", "-f", r.remote); err != nil { ++ if _, err := Run(ctx, r.dir, "git", "fetch", "--unshallow", "-f", "--end-of-options",r.remote); err != nil { + return err + } + } +@@ -615,7 +615,7 @@ func (r *gitRepo) fetchRefsLocked(ctx context.Context) error { + // statLocal returns a new RevInfo describing rev in the local git repository. + // It uses version as info.Version. + func (r *gitRepo) statLocal(ctx context.Context, version, rev string) (*RevInfo, error) { +- out, err := Run(ctx, r.dir, "git", "-c", "log.showsignature=false", "log", "--no-decorate", "-n1", "--format=format:%H %ct %D", rev, "--") ++ out, err := Run(ctx, r.dir, "git", "-c", "log.showsignature=false", "log", "--no-decorate", "-n1", "--format=format:%H %ct %D","--end-of-options", rev, "--") + if err != nil { + // Return info with Origin.RepoSum if possible to allow caching of negative lookup. + var info *RevInfo +@@ -705,7 +705,7 @@ func (r *gitRepo) ReadFile(ctx context.Context, rev, file string, maxSize int64) + if err != nil { + return nil, err + } +- out, err := Run(ctx, r.dir, "git", "cat-file", "blob", info.Name+":"+file) ++ out, err := Run(ctx, r.dir, "git", "cat-file","--end-of-options", "blob", info.Name+":"+file) + if err != nil { + return nil, fs.ErrNotExist + } +@@ -723,7 +723,7 @@ func (r *gitRepo) RecentTag(ctx context.Context, rev, prefix string, allowed fun + // result is definitive. + describe := func() (definitive bool) { + var out []byte +- out, err = Run(ctx, r.dir, "git", "for-each-ref", "--format", "%(refname)", "refs/tags", "--merged", rev) ++ out, err = Run(ctx, r.dir, "git", "for-each-ref", "--format=%(refname)", "--merged="+rev) + if err != nil { + return true + } +@@ -865,7 +865,7 @@ func (r *gitRepo) ReadZip(ctx context.Context, rev, subdir string, maxSize int64 + // TODO: Use maxSize or drop it. + args := []string{} + if subdir != "" { +- args = append(args, "--", subdir) ++ args = append(args, subdir) + } + info, err := r.Stat(ctx, rev) // download rev into local git repo + if err != nil { +@@ -887,7 +887,7 @@ func (r *gitRepo) ReadZip(ctx context.Context, rev, subdir string, maxSize int64 + // text file line endings. Setting -c core.autocrlf=input means only + // translate files on the way into the repo, not on the way out (archive). + // The -c core.eol=lf should be unnecessary but set it anyway. +- archive, err := Run(ctx, r.dir, "git", "-c", "core.autocrlf=input", "-c", "core.eol=lf", "archive", "--format=zip", "--prefix=prefix/", info.Name, args) ++ archive, err := Run(ctx, r.dir, "git", "-c", "core.autocrlf=input", "-c", "core.eol=lf", "archive", "--format=zip", "--prefix=prefix/", "--end-of-options", info.Name, args) + if err != nil { + if bytes.Contains(err.(*RunError).Stderr, []byte("did not match any files")) { + return nil, fs.ErrNotExist +diff --git a/src/cmd/go/internal/modfetch/codehost/vcs.go b/src/cmd/go/internal/modfetch/codehost/vcs.go +index 5bd100556b..425f61269f 100644 +--- a/src/cmd/go/internal/modfetch/codehost/vcs.go ++++ b/src/cmd/go/internal/modfetch/codehost/vcs.go +@@ -162,20 +162,20 @@ var vcsCmds = map[string]*vcsCmd{ + branchRE: re(`(?m)^[^\n]+$`), + badLocalRevRE: re(`(?m)^(tip)$`), + statLocal: func(rev, remote string) []string { +- return []string{"hg", "log", "-l1", "-r", rev, "--template", "{node} {date|hgdate} {tags}"} ++ return []string{"hg", "log", "-l1", fmt.Sprintf("--rev=%s", rev), "--template", "{node} {date|hgdate} {tags}"} + }, + parseStat: hgParseStat, + fetch: []string{"hg", "pull", "-f"}, + latest: "tip", + readFile: func(rev, file, remote string) []string { +- return []string{"hg", "cat", "-r", rev, file} ++ return []string{"hg", "cat", fmt.Sprintf("--rev=%s", rev), "--", file} + }, + readZip: func(rev, subdir, remote, target string) []string { + pattern := []string{} + if subdir != "" { +- pattern = []string{"-I", subdir + "/**"} ++ pattern = []string{fmt.Sprintf("--include=%s", subdir+"/**")} + } +- return str.StringList("hg", "archive", "-t", "zip", "--no-decode", "-r", rev, "--prefix=prefix/", pattern, "--", target) ++ return str.StringList("hg", "archive", "-t", "zip", "--no-decode", fmt.Sprintf("--rev=%s", rev), "--prefix=prefix/", pattern, "--", target) + }, + }, + +@@ -215,19 +215,19 @@ var vcsCmds = map[string]*vcsCmd{ + tagRE: re(`(?m)^\S+`), + badLocalRevRE: re(`^revno:-`), + statLocal: func(rev, remote string) []string { +- return []string{"bzr", "log", "-l1", "--long", "--show-ids", "-r", rev} ++ return []string{"bzr", "log", "-l1", "--long", "--show-ids", fmt.Sprintf("--revision=%s", rev)} + }, + parseStat: bzrParseStat, + latest: "revno:-1", + readFile: func(rev, file, remote string) []string { +- return []string{"bzr", "cat", "-r", rev, file} ++ return []string{"bzr", "cat", fmt.Sprintf("--revision=%s", rev), "--", file} + }, + readZip: func(rev, subdir, remote, target string) []string { + extra := []string{} + if subdir != "" { + extra = []string{"./" + subdir} + } +- return str.StringList("bzr", "export", "--format=zip", "-r", rev, "--root=prefix/", "--", target, extra) ++ return str.StringList("bzr", "export", "--format=zip", fmt.Sprintf("--revision=%s", rev), "--root=prefix/", "--", target, extra) + }, + }, + +@@ -242,17 +242,17 @@ var vcsCmds = map[string]*vcsCmd{ + }, + tagRE: re(`XXXTODO`), + statLocal: func(rev, remote string) []string { +- return []string{"fossil", "info", "-R", ".fossil", rev} ++ return []string{"fossil", "info", "-R", ".fossil", "--", rev} + }, + parseStat: fossilParseStat, + latest: "trunk", + readFile: func(rev, file, remote string) []string { +- return []string{"fossil", "cat", "-R", ".fossil", "-r", rev, file} ++ return []string{"fossil", "cat", "-R", ".fossil", fmt.Sprintf("-r=%s", rev), "--", file} + }, + readZip: func(rev, subdir, remote, target string) []string { + extra := []string{} + if subdir != "" && !strings.ContainsAny(subdir, "*?[],") { +- extra = []string{"--include", subdir} ++ extra = []string{fmt.Sprintf("--include=%s", subdir)} + } + // Note that vcsRepo.ReadZip below rewrites this command + // to run in a different directory, to work around a fossil bug. +diff --git a/src/cmd/go/internal/modget/query.go b/src/cmd/go/internal/modget/query.go +index 498ba6c2ff..0d33a52677 100644 +--- a/src/cmd/go/internal/modget/query.go ++++ b/src/cmd/go/internal/modget/query.go +@@ -139,7 +139,10 @@ func errSet(err error) pathSet { return pathSet{err: err} } + // newQuery returns a new query parsed from the raw argument, + // which must be either path or path@version. + func newQuery(raw string) (*query, error) { +- pattern, rawVers, found := strings.Cut(raw, "@") ++ pattern, rawVers, found, err := modload.ParsePathVersion(raw) ++ if err != nil { ++ return nil, err ++ } + if found && (strings.Contains(rawVers, "@") || rawVers == "") { + return nil, fmt.Errorf("invalid module version syntax %q", raw) + } +diff --git a/src/cmd/go/internal/modload/build.go b/src/cmd/go/internal/modload/build.go +index 5cf1487c3e..08acf3aa2b 100644 +--- a/src/cmd/go/internal/modload/build.go ++++ b/src/cmd/go/internal/modload/build.go +@@ -12,7 +12,6 @@ import ( + "io/fs" + "os" + "path/filepath" +- "strings" + + "cmd/go/internal/base" + "cmd/go/internal/cfg" +@@ -88,7 +87,16 @@ func ModuleInfo(ctx context.Context, path string) *modinfo.ModulePublic { + return nil + } + +- if path, vers, found := strings.Cut(path, "@"); found { ++ path, vers, found, err := ParsePathVersion(path) ++ if err != nil { ++ return &modinfo.ModulePublic{ ++ Path: path, ++ Error: &modinfo.ModuleError{ ++ Err: err.Error(), ++ }, ++ } ++ } ++ if found { + m := module.Version{Path: path, Version: vers} + return moduleInfo(ctx, nil, m, 0, nil) + } +diff --git a/src/cmd/go/internal/modload/list.go b/src/cmd/go/internal/modload/list.go +index ef93c25121..e9efb1918e 100644 +--- a/src/cmd/go/internal/modload/list.go ++++ b/src/cmd/go/internal/modload/list.go +@@ -149,7 +149,11 @@ func listModules(ctx context.Context, rs *Requirements, args []string, mode List + } + continue + } +- if path, vers, found := strings.Cut(arg, "@"); found { ++ path, vers, found, err := ParsePathVersion(arg) ++ if err != nil { ++ base.Fatalf("go: %v", err) ++ } ++ if found { + if vers == "upgrade" || vers == "patch" { + if _, ok := rs.rootSelected(path); !ok || rs.pruning == unpruned { + needFullGraph = true +@@ -175,7 +179,11 @@ func listModules(ctx context.Context, rs *Requirements, args []string, mode List + + matchedModule := map[module.Version]bool{} + for _, arg := range args { +- if path, vers, found := strings.Cut(arg, "@"); found { ++ path, vers, found, err := ParsePathVersion(arg) ++ if err != nil { ++ base.Fatalf("go: %v", err) ++ } ++ if found { + var current string + if mg == nil { + current, _ = rs.rootSelected(path) +@@ -308,3 +316,21 @@ func modinfoError(path, vers string, err error) *modinfo.ModuleError { + + return &modinfo.ModuleError{Err: err.Error()} + } ++ ++// ParsePathVersion parses arg expecting arg to be path@version. If there is no ++// '@' in arg, found is false, vers is "", and path is arg. This mirrors the ++// typical usage of strings.Cut. ParsePathVersion is meant to be a general ++// replacement for strings.Cut in module version parsing. If the version is ++// invalid, an error is returned. The version is considered invalid if it is ++// prefixed with '-' or '/', which can cause security problems when constructing ++// commands to execute that use the version. ++func ParsePathVersion(arg string) (path, vers string, found bool, err error) { ++ path, vers, found = strings.Cut(arg, "@") ++ if !found { ++ return arg, "", false, nil ++ } ++ if len(vers) > 0 && (vers[0] == '-' || vers[0] == '/') { ++ return "", "", false, fmt.Errorf("invalid module version %q", vers) ++ } ++ return path, vers, true, nil ++} +diff --git a/src/cmd/go/internal/toolchain/select.go b/src/cmd/go/internal/toolchain/select.go +index 14a8d3c21d..838ebae6a7 100644 +--- a/src/cmd/go/internal/toolchain/select.go ++++ b/src/cmd/go/internal/toolchain/select.go +@@ -614,7 +614,10 @@ func goInstallVersion() bool { + if !strings.Contains(pkgArg, "@") || build.IsLocalImport(pkgArg) || filepath.IsAbs(pkgArg) { + return false + } +- path, version, _ := strings.Cut(pkgArg, "@") ++ path, version, _, err := modload.ParsePathVersion(pkgArg) ++ if err != nil { ++ base.Fatalf("go: %v", err) ++ } + if path == "" || version == "" || gover.IsToolchain(path) { + return false + } +@@ -650,7 +653,7 @@ func goInstallVersion() bool { + allowed = nil + } + noneSelected := func(path string) (version string) { return "none" } +- _, err := modload.QueryPackages(ctx, path, version, noneSelected, allowed) ++ _, err = modload.QueryPackages(ctx, path, version, noneSelected, allowed) + if errors.Is(err, gover.ErrTooNew) { + // Run early switch, same one go install or go run would eventually do, + // if it understood all the command-line flags. +diff --git a/src/cmd/go/internal/vcs/vcs.go b/src/cmd/go/internal/vcs/vcs.go +index 60f76d77cf..55bf25ff62 100644 +--- a/src/cmd/go/internal/vcs/vcs.go ++++ b/src/cmd/go/internal/vcs/vcs.go +@@ -17,7 +17,6 @@ import ( + "os" + "os/exec" + "path/filepath" +- "regexp" + "strconv" + "strings" + "sync" +@@ -40,20 +39,10 @@ type Cmd struct { + Env []string // any environment values to set/override + RootNames []rootName // filename and mode indicating the root of a checkout directory + +- CreateCmd []string // commands to download a fresh copy of a repository +- DownloadCmd []string // commands to download updates into an existing repository +- +- TagCmd []tagCmd // commands to list tags +- TagLookupCmd []tagCmd // commands to lookup tags before running tagSyncCmd +- TagSyncCmd []string // commands to sync to specific tag +- TagSyncDefault []string // commands to sync to default tag +- + Scheme []string + PingCmd string + +- RemoteRepo func(v *Cmd, rootDir string) (remoteRepo string, err error) +- ResolveRepo func(v *Cmd, rootDir, remoteRepo string) (realRepo string, err error) +- Status func(v *Cmd, rootDir string) (Status, error) ++ Status func(v *Cmd, rootDir string) (Status, error) + } + + // Status is the current state of a local repository. +@@ -156,40 +145,16 @@ var vcsHg = &Cmd{ + Name: "Mercurial", + Cmd: "hg", + +- // HGPLAIN=1 turns off additional output that a user may have enabled via +- // config options or certain extensions. +- Env: []string{"HGPLAIN=1"}, ++ // HGPLAIN=+strictflags turns off additional output that a user may have ++ // enabled via config options or certain extensions. ++ Env: []string{"HGPLAIN=+strictflags"}, + RootNames: []rootName{ + {filename: ".hg", isDir: true}, + }, + +- CreateCmd: []string{"clone -U -- {repo} {dir}"}, +- DownloadCmd: []string{"pull"}, +- +- // We allow both tag and branch names as 'tags' +- // for selecting a version. This lets people have +- // a go.release.r60 branch and a go1 branch +- // and make changes in both, without constantly +- // editing .hgtags. +- TagCmd: []tagCmd{ +- {"tags", `^(\S+)`}, +- {"branches", `^(\S+)`}, +- }, +- TagSyncCmd: []string{"update -r {tag}"}, +- TagSyncDefault: []string{"update default"}, +- +- Scheme: []string{"https", "http", "ssh"}, +- PingCmd: "identify -- {scheme}://{repo}", +- RemoteRepo: hgRemoteRepo, +- Status: hgStatus, +-} +- +-func hgRemoteRepo(vcsHg *Cmd, rootDir string) (remoteRepo string, err error) { +- out, err := vcsHg.runOutput(rootDir, "paths default") +- if err != nil { +- return "", err +- } +- return strings.TrimSpace(string(out)), nil ++ Scheme: []string{"https", "http", "ssh"}, ++ PingCmd: "identify -- {scheme}://{repo}", ++ Status: hgStatus, + } + + func hgStatus(vcsHg *Cmd, rootDir string) (Status, error) { +@@ -252,25 +217,6 @@ var vcsGit = &Cmd{ + {filename: ".git", isDir: true}, + }, + +- CreateCmd: []string{"clone -- {repo} {dir}", "-go-internal-cd {dir} submodule update --init --recursive"}, +- DownloadCmd: []string{"pull --ff-only", "submodule update --init --recursive"}, +- +- TagCmd: []tagCmd{ +- // tags/xxx matches a git tag named xxx +- // origin/xxx matches a git branch named xxx on the default remote repository +- {"show-ref", `(?:tags|origin)/(\S+)$`}, +- }, +- TagLookupCmd: []tagCmd{ +- {"show-ref tags/{tag} origin/{tag}", `((?:tags|origin)/\S+)$`}, +- }, +- TagSyncCmd: []string{"checkout {tag}", "submodule update --init --recursive"}, +- // both createCmd and downloadCmd update the working dir. +- // No need to do more here. We used to 'checkout master' +- // but that doesn't work if the default branch is not named master. +- // DO NOT add 'checkout master' here. +- // See golang.org/issue/9032. +- TagSyncDefault: []string{"submodule update --init --recursive"}, +- + Scheme: []string{"git", "https", "http", "git+ssh", "ssh"}, + + // Leave out the '--' separator in the ls-remote command: git 2.7.4 does not +@@ -279,54 +225,7 @@ var vcsGit = &Cmd{ + // See golang.org/issue/33836. + PingCmd: "ls-remote {scheme}://{repo}", + +- RemoteRepo: gitRemoteRepo, +- Status: gitStatus, +-} +- +-// scpSyntaxRe matches the SCP-like addresses used by Git to access +-// repositories by SSH. +-var scpSyntaxRe = lazyregexp.New(`^(\w+)@([\w.-]+):(.*)$`) +- +-func gitRemoteRepo(vcsGit *Cmd, rootDir string) (remoteRepo string, err error) { +- const cmd = "config remote.origin.url" +- outb, err := vcsGit.run1(rootDir, cmd, nil, false) +- if err != nil { +- // if it doesn't output any message, it means the config argument is correct, +- // but the config value itself doesn't exist +- if outb != nil && len(outb) == 0 { +- return "", errors.New("remote origin not found") +- } +- return "", err +- } +- out := strings.TrimSpace(string(outb)) +- +- var repoURL *urlpkg.URL +- if m := scpSyntaxRe.FindStringSubmatch(out); m != nil { +- // Match SCP-like syntax and convert it to a URL. +- // Eg, "[email protected]:user/repo" becomes +- // "ssh://[email protected]/user/repo". +- repoURL = &urlpkg.URL{ +- Scheme: "ssh", +- User: urlpkg.User(m[1]), +- Host: m[2], +- Path: m[3], +- } +- } else { +- repoURL, err = urlpkg.Parse(out) +- if err != nil { +- return "", err +- } +- } +- +- // Iterate over insecure schemes too, because this function simply +- // reports the state of the repo. If we can't see insecure schemes then +- // we can't report the actual repo URL. +- for _, s := range vcsGit.Scheme { +- if repoURL.Scheme == s { +- return repoURL.String(), nil +- } +- } +- return "", errors.New("unable to parse output of git " + cmd) ++ Status: gitStatus, + } + + func gitStatus(vcsGit *Cmd, rootDir string) (Status, error) { +@@ -366,62 +265,9 @@ var vcsBzr = &Cmd{ + {filename: ".bzr", isDir: true}, + }, + +- CreateCmd: []string{"branch -- {repo} {dir}"}, +- +- // Without --overwrite bzr will not pull tags that changed. +- // Replace by --overwrite-tags after http://pad.lv/681792 goes in. +- DownloadCmd: []string{"pull --overwrite"}, +- +- TagCmd: []tagCmd{{"tags", `^(\S+)`}}, +- TagSyncCmd: []string{"update -r {tag}"}, +- TagSyncDefault: []string{"update -r revno:-1"}, +- +- Scheme: []string{"https", "http", "bzr", "bzr+ssh"}, +- PingCmd: "info -- {scheme}://{repo}", +- RemoteRepo: bzrRemoteRepo, +- ResolveRepo: bzrResolveRepo, +- Status: bzrStatus, +-} +- +-func bzrRemoteRepo(vcsBzr *Cmd, rootDir string) (remoteRepo string, err error) { +- outb, err := vcsBzr.runOutput(rootDir, "config parent_location") +- if err != nil { +- return "", err +- } +- return strings.TrimSpace(string(outb)), nil +-} +- +-func bzrResolveRepo(vcsBzr *Cmd, rootDir, remoteRepo string) (realRepo string, err error) { +- outb, err := vcsBzr.runOutput(rootDir, "info "+remoteRepo) +- if err != nil { +- return "", err +- } +- out := string(outb) +- +- // Expect: +- // ... +- // (branch root|repository branch): <URL> +- // ... +- +- found := false +- for _, prefix := range []string{"\n branch root: ", "\n repository branch: "} { +- i := strings.Index(out, prefix) +- if i >= 0 { +- out = out[i+len(prefix):] +- found = true +- break +- } +- } +- if !found { +- return "", fmt.Errorf("unable to parse output of bzr info") +- } +- +- i := strings.Index(out, "\n") +- if i < 0 { +- return "", fmt.Errorf("unable to parse output of bzr info") +- } +- out = out[:i] +- return strings.TrimSpace(out), nil ++ Scheme: []string{"https", "http", "bzr", "bzr+ssh"}, ++ PingCmd: "info -- {scheme}://{repo}", ++ Status: bzrStatus, + } + + func bzrStatus(vcsBzr *Cmd, rootDir string) (Status, error) { +@@ -489,45 +335,11 @@ var vcsSvn = &Cmd{ + {filename: ".svn", isDir: true}, + }, + +- CreateCmd: []string{"checkout -- {repo} {dir}"}, +- DownloadCmd: []string{"update"}, +- + // There is no tag command in subversion. + // The branch information is all in the path names. + +- Scheme: []string{"https", "http", "svn", "svn+ssh"}, +- PingCmd: "info -- {scheme}://{repo}", +- RemoteRepo: svnRemoteRepo, +-} +- +-func svnRemoteRepo(vcsSvn *Cmd, rootDir string) (remoteRepo string, err error) { +- outb, err := vcsSvn.runOutput(rootDir, "info") +- if err != nil { +- return "", err +- } +- out := string(outb) +- +- // Expect: +- // +- // ... +- // URL: <URL> +- // ... +- // +- // Note that we're not using the Repository Root line, +- // because svn allows checking out subtrees. +- // The URL will be the URL of the subtree (what we used with 'svn co') +- // while the Repository Root may be a much higher parent. +- i := strings.Index(out, "\nURL: ") +- if i < 0 { +- return "", fmt.Errorf("unable to parse output of svn info") +- } +- out = out[i+len("\nURL: "):] +- i = strings.Index(out, "\n") +- if i < 0 { +- return "", fmt.Errorf("unable to parse output of svn info") +- } +- out = out[:i] +- return strings.TrimSpace(out), nil ++ Scheme: []string{"https", "http", "svn", "svn+ssh"}, ++ PingCmd: "info -- {scheme}://{repo}", + } + + // fossilRepoName is the name go get associates with a fossil repository. In the +@@ -543,24 +355,8 @@ var vcsFossil = &Cmd{ + {filename: "_FOSSIL_", isDir: false}, + }, + +- CreateCmd: []string{"-go-internal-mkdir {dir} clone -- {repo} " + filepath.Join("{dir}", fossilRepoName), "-go-internal-cd {dir} open .fossil"}, +- DownloadCmd: []string{"up"}, +- +- TagCmd: []tagCmd{{"tag ls", `(.*)`}}, +- TagSyncCmd: []string{"up tag:{tag}"}, +- TagSyncDefault: []string{"up trunk"}, +- +- Scheme: []string{"https", "http"}, +- RemoteRepo: fossilRemoteRepo, +- Status: fossilStatus, +-} +- +-func fossilRemoteRepo(vcsFossil *Cmd, rootDir string) (remoteRepo string, err error) { +- out, err := vcsFossil.runOutput(rootDir, "remote-url") +- if err != nil { +- return "", err +- } +- return strings.TrimSpace(string(out)), nil ++ Scheme: []string{"https", "http"}, ++ Status: fossilStatus, + } + + var errFossilInfo = errors.New("unable to parse output of fossil info") +@@ -661,7 +457,7 @@ func (v *Cmd) run1(dir string, cmdline string, keyval []string, verbose bool) ([ + args[i] = expand(m, arg) + } + +- if len(args) >= 2 && args[0] == "-go-internal-mkdir" { ++ if len(args) >= 2 && args[0] == "--go-internal-mkdir" { + var err error + if filepath.IsAbs(args[1]) { + err = os.Mkdir(args[1], fs.ModePerm) +@@ -674,7 +470,7 @@ func (v *Cmd) run1(dir string, cmdline string, keyval []string, verbose bool) ([ + args = args[2:] + } + +- if len(args) >= 2 && args[0] == "-go-internal-cd" { ++ if len(args) >= 2 && args[0] == "--go-internal-cd" { + if filepath.IsAbs(args[1]) { + dir = args[1] + } else { +@@ -735,99 +531,6 @@ func (v *Cmd) Ping(scheme, repo string) error { + return v.runVerboseOnly(dir, v.PingCmd, "scheme", scheme, "repo", repo) + } + +-// Create creates a new copy of repo in dir. +-// The parent of dir must exist; dir must not. +-func (v *Cmd) Create(dir, repo string) error { +- release, err := base.AcquireNet() +- if err != nil { +- return err +- } +- defer release() +- +- for _, cmd := range v.CreateCmd { +- if err := v.run(filepath.Dir(dir), cmd, "dir", dir, "repo", repo); err != nil { +- return err +- } +- } +- return nil +-} +- +-// Download downloads any new changes for the repo in dir. +-func (v *Cmd) Download(dir string) error { +- release, err := base.AcquireNet() +- if err != nil { +- return err +- } +- defer release() +- +- for _, cmd := range v.DownloadCmd { +- if err := v.run(dir, cmd); err != nil { +- return err +- } +- } +- return nil +-} +- +-// Tags returns the list of available tags for the repo in dir. +-func (v *Cmd) Tags(dir string) ([]string, error) { +- var tags []string +- for _, tc := range v.TagCmd { +- out, err := v.runOutput(dir, tc.cmd) +- if err != nil { +- return nil, err +- } +- re := regexp.MustCompile(`(?m-s)` + tc.pattern) +- for _, m := range re.FindAllStringSubmatch(string(out), -1) { +- tags = append(tags, m[1]) +- } +- } +- return tags, nil +-} +- +-// TagSync syncs the repo in dir to the named tag, +-// which either is a tag returned by tags or is v.tagDefault. +-func (v *Cmd) TagSync(dir, tag string) error { +- if v.TagSyncCmd == nil { +- return nil +- } +- if tag != "" { +- for _, tc := range v.TagLookupCmd { +- out, err := v.runOutput(dir, tc.cmd, "tag", tag) +- if err != nil { +- return err +- } +- re := regexp.MustCompile(`(?m-s)` + tc.pattern) +- m := re.FindStringSubmatch(string(out)) +- if len(m) > 1 { +- tag = m[1] +- break +- } +- } +- } +- +- release, err := base.AcquireNet() +- if err != nil { +- return err +- } +- defer release() +- +- if tag == "" && v.TagSyncDefault != nil { +- for _, cmd := range v.TagSyncDefault { +- if err := v.run(dir, cmd); err != nil { +- return err +- } +- } +- return nil +- } +- +- for _, cmd := range v.TagSyncCmd { +- if err := v.run(dir, cmd, "tag", tag); err != nil { +- return err +- } +- } +- return nil +-} +- + // A vcsPath describes how to convert an import path into a + // version control system and repository name. + type vcsPath struct { +diff --git a/src/cmd/go/internal/workcmd/edit.go b/src/cmd/go/internal/workcmd/edit.go +index 8d975b0b3d..c1252cc95e 100644 +--- a/src/cmd/go/internal/workcmd/edit.go ++++ b/src/cmd/go/internal/workcmd/edit.go +@@ -242,7 +242,10 @@ func allowedVersionArg(arg string) bool { + // parsePathVersionOptional parses path[@version], using adj to + // describe any errors. + func parsePathVersionOptional(adj, arg string, allowDirPath bool) (path, version string, err error) { +- before, after, found := strings.Cut(arg, "@") ++ before, after, found, err := modload.ParsePathVersion(arg) ++ if err != nil { ++ return "", "", err ++ } + if !found { + path = arg + } else { +-- +2.35.6 -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#231009): https://lists.openembedded.org/g/openembedded-core/message/231009 Mute This Topic: https://lists.openembedded.org/mt/117770223/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
