Skip to content

Commit 07e3195

Browse files
rolandshoemakerrolandshoemaker
committed
[release-branch.go1.15-security] all: introduce and use internal/execabs
Introduces a wrapper around os/exec, internal/execabs, for use in all commands. This wrapper prevents exec.LookPath and exec.Command from running executables in the current directory. All imports of os/exec in non-test files in cmd/ are replaced with imports of internal/execabs. This issue was reported by RyotaK. Fixes CVE-2021-3115 Change-Id: I0423451a6e27ec1e1d6f3fe929ab1ef69145c08f Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/955304 Reviewed-by: Russ Cox <[email protected]> Reviewed-by: Katie Hockman <[email protected]> (cherry picked from commit 44f09a6990ccf4db601cbf8208c89ac4e888f884) Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/955308
1 parent b210522 commit 07e3195

38 files changed

Lines changed: 221 additions & 36 deletions

File tree

‎src/cmd/api/goapi.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,11 @@ import (
1616
"go/parser"
1717
"go/token"
1818
"go/types"
19+
exec "internal/execabs"
1920
"io"
2021
"io/ioutil"
2122
"log"
2223
"os"
23-
"os/exec"
2424
"path/filepath"
2525
"regexp"
2626
"runtime"

‎src/cmd/api/run.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ package main
1010

1111
import (
1212
"fmt"
13+
exec "internal/execabs"
1314
"log"
1415
"os"
15-
"os/exec"
1616
"path/filepath"
1717
"runtime"
1818
"strings"

‎src/cmd/cgo/out.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@ import (
1313
"go/ast"
1414
"go/printer"
1515
"go/token"
16+
exec "internal/execabs"
1617
"internal/xcoff"
1718
"io"
1819
"io/ioutil"
1920
"os"
20-
"os/exec"
2121
"path/filepath"
2222
"regexp"
2323
"sort"

‎src/cmd/cgo/util.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ import (
88
"bytes"
99
"fmt"
1010
"go/token"
11+
exec "internal/execabs"
1112
"io/ioutil"
1213
"os"
13-
"os/exec"
1414
)
1515

1616
// run runs the command argv, feeding in stdin on standard input.

‎src/cmd/compile/internal/ssa/html.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ import (
99
"cmd/internal/src"
1010
"fmt"
1111
"html"
12+
exec "internal/execabs"
1213
"io"
1314
"os"
14-
"os/exec"
1515
"path/filepath"
1616
"strconv"
1717
"strings"

‎src/cmd/cover/func.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@ import (
1515
"go/ast"
1616
"go/parser"
1717
"go/token"
18+
exec "internal/execabs"
1819
"io"
1920
"os"
20-
"os/exec"
2121
"path"
2222
"path/filepath"
2323
"runtime"

‎src/cmd/cover/testdata/toolexec.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ package main
1616

1717
import (
1818
"os"
19-
"os/exec"
19+
exec "internal/execabs"
2020
"strings"
2121
)
2222

‎src/cmd/dist/buildtool.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -302,8 +302,10 @@ func bootstrapFixImports(srcFile string) string {
302302
continue
303303
}
304304
if strings.HasPrefix(line, `import "`) || strings.HasPrefix(line, `import . "`) ||
305-
inBlock && (strings.HasPrefix(line, "\t\"") || strings.HasPrefix(line, "\t. \"")) {
305+
inBlock && (strings.HasPrefix(line, "\t\"") || strings.HasPrefix(line, "\t. \"") || strings.HasPrefix(line, "\texec \"")) {
306306
line = strings.Replace(line, `"cmd/`, `"bootstrap/cmd/`, -1)
307+
// During bootstrap, must use plain os/exec.
308+
line = strings.Replace(line, `exec "internal/execabs"`, `"os/exec"`, -1)
307309
for _, dir := range bootstrapDirs {
308310
if strings.HasPrefix(dir, "cmd/") {
309311
continue

‎src/cmd/doc/dirs.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ package main
77
import (
88
"bytes"
99
"fmt"
10+
exec "internal/execabs"
1011
"log"
1112
"os"
12-
"os/exec"
1313
"path/filepath"
1414
"regexp"
1515
"strings"

‎src/cmd/fix/typecheck.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ import (
99
"go/ast"
1010
"go/parser"
1111
"go/token"
12+
exec "internal/execabs"
1213
"io/ioutil"
1314
"os"
14-
"os/exec"
1515
"path/filepath"
1616
"reflect"
1717
"runtime"

0 commit comments

Comments
 (0)