qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-23 14:20:05 -07:00
Code Releases Activity

cmd/go/internal/modload: ignore disallowed errors when checking for updates

Browse Source 
addUpdate calls Query with the query "upgrade". Normally, this returns
the highest release version (or prerelease, etc.) that is higher than
the current version and is not retracted or excluded. If there is no
such version, Query should return the current version. If the current
version is retracted or excluded, then Query currently returns an error.

addUpdate should ignore this error, as it ignores ErrNotExist and
NoMatchingVersionError. For 'go list -m -u', addRetraction is also
called, and that will detect the retraction.

Fixes #53594

Change-Id: I90a2872cdeabf03894acad9e0cbdd7db4a4e269e
Reviewed-on: https://go-review.googlesource.com/c/go/+/414825
Run-TryBot: Bryan Mills <bcmills@google.com>
Reviewed-by: Bryan Mills <bcmills@google.com>
Auto-Submit: Bryan Mills <bcmills@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
This commit is contained in:
Jay Conrod 2022-06-28 18:15:32 -07:00 committed by Gopher Robot
parent b2b8872c87
commit 27794c4d4a
3 changed files with 26 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/cmd/go/internal/modload/build.go
View File

@ -131,10 +131,15 @@ func addUpdate(ctx context.Context, m *modinfo.ModulePublic) {
info, err := Query(ctx, m.Path, "upgrade", m.Version, CheckAllowed)
var noVersionErr *NoMatchingVersionError
if errors.Is(err, fs.ErrNotExist) || errors.As(err, &noVersionErr) {
if errors.Is(err, ErrDisallowed) ||
errors.Is(err, fs.ErrNotExist) ||
errors.As(err, &noVersionErr) {
// Ignore "not found" and "no matching version" errors.
// This means the proxy has no matching version or no versions at all.
//
// Ignore "disallowed" errors. This means the current version is
// excluded or retracted and there are no higher allowed versions.
//
// We should report other errors though. An attacker that controls the
// network shouldn't be able to hide versions by interfering with
// the HTTPS connection. An attacker that controls the proxy may still

9
src/cmd/go/testdata/mod/example.com_retract_noupgrade_v1.0.0.txt vendored Normal file
View File

@ -0,0 +1,9 @@
-- .mod --
module example.com/retract/noupgrade
go 1.19
retract v1.0.0 // bad
-- .info --
{"Version":"v1.0.0"}

11
src/cmd/go/testdata/script/mod_retract_noupgrade.txt vendored Normal file
View File

@ -0,0 +1,11 @@
go list -m -u example.com/retract/noupgrade
stdout '^example.com/retract/noupgrade v1.0.0 \(retracted\)$'
-- go.mod --
module use
go 1.19
require example.com/retract/noupgrade v1.0.0
-- go.sum --
example.com/retract/noupgrade v1.0.0/go.mod h1:q2/HnBejUQ83RcUo4stf2U++/Zr9R/Ky3BsodjKBkQ4=