Skip to content

G
go
Switch branch/tag
  1. 17 May, 2019 1 commit
    • Jason A. Donenfeld's avatar
      [release-branch.go1.12] os: pass correct environment when creating Windows processes · afcfe0d3
      Jason A. Donenfeld authored 
      This is CVE-2019-11888.

Previously, passing a nil environment but a non-nil token would result
in the new potentially unprivileged process inheriting the parent
potentially privileged environment, or would result in the new
potentially privileged process inheriting the parent potentially
unprivileged environment. Either way, it's bad. In the former case, it's
an infoleak. In the latter case, it's a possible EoP, since things like
PATH could be overwritten.

Not specifying an environment currently means, "use the existing
environment". This commit amends the behavior to be, "use the existing
environment of the token the process is being created for." The behavior
therefore stays the same when creating processes without specifying a
token. And it does the correct thing when creating processes when
specifying a token.

Updates #32000
Fixes #32081

Change-Id: Ib4a90cfffb6ba866c855f66f1313372fdd34ce41
Reviewed-on: https://go-review.googlesource.com/c/go/+/177538
Run-TryBot: Jason Donenfeld <Jason@zx2c4.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: default avatarIan Lance Taylor <iant@golang.org>
      afcfe0d3
  3. 14 May, 2019 1 commit
  5. 08 May, 2019 1 commit
  7. 06 May, 2019 6 commits
  9. 01 May, 2019 2 commits
    • Russ Cox's avatar
      [release-branch.go1.12] cmd/vet: add tests for point-release issues · dc6db5f4
      Russ Cox authored 
      Add explicit tests for:

 #30465	cmd/vet: Consider reverting tag conflict for embedded fields
 #30399	cmd/vet: possible to get a printf false positive with big.Int

because we have managed not to fix them in the last
couple point releases, and it will be too embarrassing
to do that yet again.

Change-Id: Ib1da5df870348b6eb9bfc8a87c507ecc6d44b8dd
Reviewed-on: https://go-review.googlesource.com/c/go/+/174520
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: default avatarBrad Fitzpatrick <bradfitz@golang.org>
      dc6db5f4
    • Russ Cox's avatar
      [release-branch.go1.12] cmd/vendor/golang.org/x/tools/go/analysis: update from... · 9ac70939
      Russ Cox authored 
      [release-branch.go1.12] cmd/vendor/golang.org/x/tools/go/analysis: update from release-branch.go1.12

$ ./update-xtools.sh
Copied /Users/rsc/src/golang.org/x/tools@aa829657 to .
$ cd ~/src/golang.org/x/tools
$ git log -n1 aa829657
commit aa82965741a9fecd12b026fbb3d3c6ed3231b8f8 (HEAD -> release-branch.go1.12, origin/release-branch.go1.12)
Author:     Daniel Martí <mvdan@mvdan.cc>
AuthorDate: Fri Mar 1 11:00:19 2019 +0000
Commit:     Brad Fitzpatrick <bradfitz@golang.org>
CommitDate: Wed Mar 13 21:06:03 2019 +0000
...
$

Picks up cmd/vet fixes that have been inadvertently missed in point releases so far.

Fixes #30399.
Fixes #30465.

Change-Id: Ibcfaac51d134205b986b32f857d54006b19c896a
Reviewed-on: https://go-review.googlesource.com/c/go/+/174519
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: default avatarBrad Fitzpatrick <bradfitz@golang.org>
      9ac70939
  11. 29 Apr, 2019 1 commit
  13. 26 Apr, 2019 2 commits
  15. 23 Apr, 2019 1 commit
  17. 22 Apr, 2019 1 commit
  19. 18 Apr, 2019 1 commit
  21. 16 Apr, 2019 1 commit
  23. 15 Apr, 2019 1 commit
  25. 11 Apr, 2019 2 commits
  27. 08 Apr, 2019 5 commits
  29. 05 Apr, 2019 8 commits
  31. 04 Apr, 2019 1 commit
  33. 02 Apr, 2019 4 commits
  35. 27 Mar, 2019 1 commit
    • Dmitri Shuralyov's avatar
      [release-branch.go1.12] cmd/go: fix the default build output name for versioned binaries · aeb9d03e
      Dmitri Shuralyov authored 
      This change is a re-apply of the reverted CL 140863 with changes to
address issue #30821. Specifically, path.Split continues to be used
to split the '/'-separated import path, rather than filepath.Split.

Document the algorithm for how the default executable name is determined
in DefaultExecName.

Rename a variable returned from os.Stat from bs to fi for consistency.

CL 140863 factored out the logic to determine the default executable
name from the Package.load method into a DefaultExecName function,
and started using it in more places to avoid having to re-implement
the logic everywhere it's needed. Most previous callers already computed
the default executable name based on the import path. The load.Package
method, before CL 140863, was the exception, in that it used the p.Dir
value in GOPATH mode instead. There was a NOTE(rsc) comment that it
should be equivalent to use import path, but it was too late in Go 1.11
cycle to risk implementing that change.

This is part 1, a more conservative change for backporting to Go 1.12.2,
and it keeps the original behavior of splitting on p.Dir in GOPATH mode.
Part 2 will address the NOTE(rsc) comment and modify behavior in
Package.load to always use DefaultExecName which splits the import path
rather than directory. It is intended to be included in Go 1.13.

Updates #27283
Updates #26869
Updates #30821
Fixes #30266

Change-Id: Ib1ebb95acba7c85c24e3a55c40cdf48405af34f3
Reviewed-on: https://go-review.googlesource.com/c/go/+/167503Reviewed-by: default avatarJay Conrod <jayconrod@google.com>
Reviewed-by: default avatarHyang-Ah Hana Kim <hyangah@gmail.com>
(cherry picked from commit 94563de8)
Reviewed-on: https://go-review.googlesource.com/c/go/+/168958
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
      aeb9d03e
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7