qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-22 17:44:46 -07:00
Code Releases Activity

cmd/go: add a regression test for 'go mod vendor' path traversal

Browse Source 
For #46867

Change-Id: I1547ebf7b91e9ddd7b67fd2f20e91391d79fa35d
Reviewed-on: https://go-review.googlesource.com/c/go/+/332250
Trust: Bryan C. Mills <bcmills@google.com>
Run-TryBot: Bryan C. Mills <bcmills@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Jay Conrod <jayconrod@google.com>
This commit is contained in:
Bryan C. Mills 2021-07-01 12:32:05 -04:00
parent 835d86a17e
commit 770899f7e1
1 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
src/cmd/go/testdata/script/mod_vendor_issue46867.txt vendored Normal file
View File

@ -0,0 +1,31 @@
# Regression test for golang.org/issue/46867:
# 'go mod vendor' on Windows attempted to open and copy
# files from directories outside of the module.
cd subdir
go mod vendor
! exists vendor/example.net/NOTICE
exists vendor/example.net/m/NOTICE
-- subdir/go.mod --
module golang.org/issue46867
go 1.17
replace example.net/m v0.1.0 => ./m
require example.net/m v0.1.0
-- subdir/issue.go --
package issue
import _ "example.net/m/n"
-- subdir/m/go.mod --
module example.net/m
go 1.17
-- subdir/m/n/n.go --
package n
-- subdir/m/NOTICE --
This notice is in module m and SHOULD be vendored.
-- subdir/NOTICE --
This notice is outside of module m and SHOULD NOT be vendored.