From dc725bfb3c3f29c7395e088d25ef6bf8dba8f129 Mon Sep 17 00:00:00 2001
From: KimMachineGun
Date: Mon, 8 Feb 2021 23:27:52 +0000
Subject: [PATCH 01/12] doc/go1.16: mention new vet check for asn1.Unmarshal
This vet check was added in CL 243397.
For #40700.
Change-Id: Ibff6df9395d37bb2b84a791443578009f23af4fb
GitHub-Last-Rev: e47c38f6309f31a6de48d4ffc82078d7ad45b171
GitHub-Pull-Request: golang/go#44147
Reviewed-on: https://go-review.googlesource.com/c/go/+/290330
Trust: Ian Lance Taylor
Reviewed-by: Dmitri Shuralyov
---
doc/go1.16.html | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/doc/go1.16.html b/doc/go1.16.html
index 878bf0d0293..f6f72c3882c 100644
--- a/doc/go1.16.html
+++ b/doc/go1.16.html
@@ -378,6 +378,16 @@ func TestFoo(t *testing.T) {
fixes.
+New warning for asn1.Unmarshal
+
+
+ The vet tool now warns about incorrectly passing a non-pointer or nil argument to
+ asn1.Unmarshal
.
+ This is like the existing checks for
+ encoding/json.Unmarshal
+ and encoding/xml.Unmarshal
.
+
+
Runtime
From cea4e21b525ad6b465f62741680eaa0a44e9cc3e Mon Sep 17 00:00:00 2001
From: Ian Lance Taylor
Date: Mon, 8 Feb 2021 16:32:39 -0800
Subject: [PATCH 02/12] io/fs: backslash is always a glob meta character
Fixes #44171
Change-Id: I2d3437a2f5b9fa0358e4664e1a8eacebed975eed
Reviewed-on: https://go-review.googlesource.com/c/go/+/290512
Trust: Ian Lance Taylor
Run-TryBot: Ian Lance Taylor
TryBot-Result: Go Bot
Reviewed-by: Rob Pike
Reviewed-by: Russ Cox
---
src/io/fs/glob.go | 5 ++---
src/io/fs/glob_test.go | 3 ++-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/io/fs/glob.go b/src/io/fs/glob.go
index 549f2175429..45d9cb61b96 100644
--- a/src/io/fs/glob.go
+++ b/src/io/fs/glob.go
@@ -6,7 +6,6 @@ package fs
import (
"path"
- "runtime"
)
// A GlobFS is a file system with a Glob method.
@@ -111,8 +110,8 @@ func glob(fs FS, dir, pattern string, matches []string) (m []string, e error) {
// recognized by path.Match.
func hasMeta(path string) bool {
for i := 0; i < len(path); i++ {
- c := path[i]
- if c == '*' || c == '?' || c == '[' || runtime.GOOS == "windows" && c == '\\' {
+ switch path[i] {
+ case '*', '?', '[', '\\':
return true
}
}
diff --git a/src/io/fs/glob_test.go b/src/io/fs/glob_test.go
index f0d791fab5a..f19bebed77f 100644
--- a/src/io/fs/glob_test.go
+++ b/src/io/fs/glob_test.go
@@ -17,6 +17,7 @@ var globTests = []struct {
}{
{os.DirFS("."), "glob.go", "glob.go"},
{os.DirFS("."), "gl?b.go", "glob.go"},
+ {os.DirFS("."), `gl\ob.go`, "glob.go"},
{os.DirFS("."), "*", "glob.go"},
{os.DirFS(".."), "*/glob.go", "fs/glob.go"},
}
@@ -32,7 +33,7 @@ func TestGlob(t *testing.T) {
t.Errorf("Glob(%#q) = %#v want %v", tt.pattern, matches, tt.result)
}
}
- for _, pattern := range []string{"no_match", "../*/no_match"} {
+ for _, pattern := range []string{"no_match", "../*/no_match", `\*`} {
matches, err := Glob(os.DirFS("."), pattern)
if err != nil {
t.Errorf("Glob error for %q: %s", pattern, err)
From c9d6f45fec19a9cb66ddd89d61bfa982f5bf4afe Mon Sep 17 00:00:00 2001
From: Ian Lance Taylor
Date: Sun, 7 Feb 2021 15:25:39 -0800
Subject: [PATCH 03/12] runtime/metrics: fix a couple of documentation typpos
Fixes #44150
Change-Id: Ibe5bfba01491dd8c2f0696fab40a1673230d76e9
Reviewed-on: https://go-review.googlesource.com/c/go/+/290349
Trust: Ian Lance Taylor
Run-TryBot: Ian Lance Taylor
TryBot-Result: Go Bot
Reviewed-by: Dmitri Shuralyov
Reviewed-by: Michael Knyszek
---
src/runtime/metrics/doc.go | 7 ++++---
src/runtime/metrics/sample.go | 6 +++---
src/runtime/metrics/value.go | 2 +-
3 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/src/runtime/metrics/doc.go b/src/runtime/metrics/doc.go
index 021a0bddcaf..5da050f973b 100644
--- a/src/runtime/metrics/doc.go
+++ b/src/runtime/metrics/doc.go
@@ -16,13 +16,14 @@ Interface
Metrics are designated by a string key, rather than, for example, a field name in
a struct. The full list of supported metrics is always available in the slice of
Descriptions returned by All. Each Description also includes useful information
-about the metric, such as how to display it (e.g. gauge vs. counter) and how difficult
-or disruptive it is to obtain it (e.g. do you need to stop the world?).
+about the metric, such as how to display it (for example, gauge vs. counter)
+and how difficult or disruptive it is to obtain it (for example, do you need to
+stop the world?).
Thus, users of this API are encouraged to sample supported metrics defined by the
slice returned by All to remain compatible across Go versions. Of course, situations
arise where reading specific metrics is critical. For these cases, users are
-encouranged to use build tags, and although metrics may be deprecated and removed,
+encouraged to use build tags, and although metrics may be deprecated and removed,
users should consider this to be an exceptional and rare event, coinciding with a
very large change in a particular Go implementation.
diff --git a/src/runtime/metrics/sample.go b/src/runtime/metrics/sample.go
index 35534dd70da..b3933e266ed 100644
--- a/src/runtime/metrics/sample.go
+++ b/src/runtime/metrics/sample.go
@@ -32,9 +32,9 @@ func runtime_readMetrics(unsafe.Pointer, int, int)
//
// Note that re-use has some caveats. Notably, Values should not be read or
// manipulated while a Read with that value is outstanding; that is a data race.
-// This property includes pointer-typed Values (e.g. Float64Histogram) whose
-// underlying storage will be reused by Read when possible. To safely use such
-// values in a concurrent setting, all data must be deep-copied.
+// This property includes pointer-typed Values (for example, Float64Histogram)
+// whose underlying storage will be reused by Read when possible. To safely use
+// such values in a concurrent setting, all data must be deep-copied.
//
// It is safe to execute multiple Read calls concurrently, but their arguments
// must share no underlying memory. When in doubt, create a new []Sample from
diff --git a/src/runtime/metrics/value.go b/src/runtime/metrics/value.go
index 61e8a192a30..ed9a33d87cc 100644
--- a/src/runtime/metrics/value.go
+++ b/src/runtime/metrics/value.go
@@ -33,7 +33,7 @@ type Value struct {
pointer unsafe.Pointer // contains non-scalar values.
}
-// Kind returns the a tag representing the kind of value this is.
+// Kind returns the tag representing the kind of value this is.
func (v Value) Kind() ValueKind {
return v.kind
}
From e0ac989cf3e43ec77c7205a66cb1cd63dd4d3043 Mon Sep 17 00:00:00 2001
From: Emmanuel T Odeke
Date: Thu, 4 Feb 2021 01:39:18 -0800
Subject: [PATCH 04/12] archive/tar: detect out of bounds accesses in PAX
records resulting from padded lengths
Handles the case in which padding of a PAX record's length field
violates invariants about the formatting of record, whereby it no
longer matches the prescribed format:
"%d %s=%s\n", , ,
as per:
https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_03
0-padding, and paddings of other sorts weren't handled and we assumed
that only non-padded decimal lengths would be passed in.
Added test cases to ensure that the parsing still proceeds as expected.
The prior crashing repro:
0000000000000000000000000000000030 mtime=1432668921.098285006\n30 ctime=2147483649.15163319
exposed the fallacy in the code, that assumed that the length would ALWAYS be a
non-padded decimal length string.
This bug has existed since Go1.1 as per CL 6700047.
Thanks to Josh Bleecher Snyder for fuzzing this package, and thanks to Tom
Thorogood for advocacy, raising parity with GNU Tar, but for providing more test cases.
Fixes #40196
Change-Id: I32e0af4887bc9221481bd9e8a5120a79f177f08c
Reviewed-on: https://go-review.googlesource.com/c/go/+/289629
Trust: Emmanuel Odeke
Trust: Joe Tsai
Run-TryBot: Emmanuel Odeke
TryBot-Result: Go Bot
Reviewed-by: Joe Tsai
---
src/archive/tar/strconv.go | 21 ++++++++++++++++++++-
src/archive/tar/strconv_test.go | 7 +++++++
2 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/src/archive/tar/strconv.go b/src/archive/tar/strconv.go
index 6d0a4038082..f0b61e6dba6 100644
--- a/src/archive/tar/strconv.go
+++ b/src/archive/tar/strconv.go
@@ -265,8 +265,27 @@ func parsePAXRecord(s string) (k, v, r string, err error) {
return "", "", s, ErrHeader
}
+ afterSpace := int64(sp + 1)
+ beforeLastNewLine := n - 1
+ // In some cases, "length" was perhaps padded/malformed, and
+ // trying to index past where the space supposedly is goes past
+ // the end of the actual record.
+ // For example:
+ // "0000000000000000000000000000000030 mtime=1432668921.098285006\n30 ctime=2147483649.15163319"
+ // ^ ^
+ // | |
+ // | afterSpace=35
+ // |
+ // beforeLastNewLine=29
+ // yet indexOf(firstSpace) MUST BE before endOfRecord.
+ //
+ // See https://golang.org/issues/40196.
+ if afterSpace >= beforeLastNewLine {
+ return "", "", s, ErrHeader
+ }
+
// Extract everything between the space and the final newline.
- rec, nl, rem := s[sp+1:n-1], s[n-1:n], s[n:]
+ rec, nl, rem := s[afterSpace:beforeLastNewLine], s[beforeLastNewLine:n], s[n:]
if nl != "\n" {
return "", "", s, ErrHeader
}
diff --git a/src/archive/tar/strconv_test.go b/src/archive/tar/strconv_test.go
index dd3505a758a..add65e272ae 100644
--- a/src/archive/tar/strconv_test.go
+++ b/src/archive/tar/strconv_test.go
@@ -368,6 +368,13 @@ func TestParsePAXRecord(t *testing.T) {
{"16 longkeyname=hahaha\n", "16 longkeyname=hahaha\n", "", "", false},
{"3 somelongkey=\n", "3 somelongkey=\n", "", "", false},
{"50 tooshort=\n", "50 tooshort=\n", "", "", false},
+ {"0000000000000000000000000000000030 mtime=1432668921.098285006\n30 ctime=2147483649.15163319", "0000000000000000000000000000000030 mtime=1432668921.098285006\n30 ctime=2147483649.15163319", "mtime", "1432668921.098285006", false},
+ {"06 k=v\n", "06 k=v\n", "", "", false},
+ {"00006 k=v\n", "00006 k=v\n", "", "", false},
+ {"000006 k=v\n", "000006 k=v\n", "", "", false},
+ {"000000 k=v\n", "000000 k=v\n", "", "", false},
+ {"0 k=v\n", "0 k=v\n", "", "", false},
+ {"+0000005 x=\n", "+0000005 x=\n", "", "", false},
}
for _, v := range vectors {
From e9c96835971044aa4ace37c7787de231bbde05d9 Mon Sep 17 00:00:00 2001
From: "Bryan C. Mills"
Date: Thu, 4 Feb 2021 15:26:52 -0500
Subject: [PATCH 05/12] cmd/go: suppress errors from 'go get -d' for packages
that only conditionally exist
Fixes #44106
Fixes #29268
Change-Id: Id113f2ced274d43fbf66cb804581448218996f81
Reviewed-on: https://go-review.googlesource.com/c/go/+/289769
TryBot-Result: Go Bot
Reviewed-by: Jay Conrod
Trust: Bryan C. Mills
Run-TryBot: Bryan C. Mills
---
src/cmd/go/internal/modget/get.go | 20 ++-
.../go/testdata/script/mod_get_pkgtags.txt | 116 ++++++++++++++++++
2 files changed, 131 insertions(+), 5 deletions(-)
create mode 100644 src/cmd/go/testdata/script/mod_get_pkgtags.txt
diff --git a/src/cmd/go/internal/modget/get.go b/src/cmd/go/internal/modget/get.go
index 574f3e194d1..1a8c9d37255 100644
--- a/src/cmd/go/internal/modget/get.go
+++ b/src/cmd/go/internal/modget/get.go
@@ -380,10 +380,9 @@ func runGet(ctx context.Context, cmd *base.Command, args []string) {
pkgs := load.PackagesAndErrors(ctx, pkgPatterns)
load.CheckPackageErrors(pkgs)
work.InstallPackages(ctx, pkgPatterns, pkgs)
- // TODO(#40276): After Go 1.16, print a deprecation notice when building
- // and installing main packages. 'go install pkg' or
- // 'go install pkg@version' should be used instead.
- // Give the specific argument to use if possible.
+ // TODO(#40276): After Go 1.16, print a deprecation notice when building and
+ // installing main packages. 'go install pkg' or 'go install pkg@version'
+ // should be used instead. Give the specific argument to use if possible.
}
if !modload.HasModRoot() {
@@ -1453,7 +1452,18 @@ func (r *resolver) checkPackagesAndRetractions(ctx context.Context, pkgPatterns
}
}
for _, pkg := range pkgs {
- if _, _, err := modload.Lookup("", false, pkg); err != nil {
+ if dir, _, err := modload.Lookup("", false, pkg); err != nil {
+ if dir != "" && errors.Is(err, imports.ErrNoGo) {
+ // Since dir is non-empty, we must have located source files
+ // associated with either the package or its test — ErrNoGo must
+ // indicate that none of those source files happen to apply in this
+ // configuration. If we are actually building the package (no -d
+ // flag), the compiler will report the problem; otherwise, assume that
+ // the user is going to build or test it in some other configuration
+ // and suppress the error.
+ continue
+ }
+
base.SetExitStatus(1)
if ambiguousErr := (*modload.AmbiguousImportError)(nil); errors.As(err, &ambiguousErr) {
for _, m := range ambiguousErr.Modules {
diff --git a/src/cmd/go/testdata/script/mod_get_pkgtags.txt b/src/cmd/go/testdata/script/mod_get_pkgtags.txt
new file mode 100644
index 00000000000..c0a57f3fab2
--- /dev/null
+++ b/src/cmd/go/testdata/script/mod_get_pkgtags.txt
@@ -0,0 +1,116 @@
+# https://golang.org/issue/44106
+# 'go get' should fetch the transitive dependencies of packages regardless of
+# tags, but shouldn't error out if the package is missing tag-guarded
+# dependencies.
+
+# Control case: just adding the top-level module to the go.mod file does not
+# fetch its dependencies.
+
+go mod edit -require example.net/tools@v0.1.0
+! go list -deps example.net/cmd/tool
+stderr '^module example\.net/cmd provides package example\.net/cmd/tool and is replaced but not required; to add it:\n\tgo get example\.net/cmd@v0\.1\.0$'
+go mod edit -droprequire example.net/tools
+
+
+# 'go get -d' makes a best effort to fetch those dependencies, but shouldn't
+# error out if dependencies of tag-guarded files are missing.
+
+go get -d example.net/tools@v0.1.0
+
+! go list example.net/tools
+stderr '^package example.net/tools: build constraints exclude all Go files in .*[/\\]tools$'
+
+go list -tags=tools -e -deps example.net/tools
+stdout '^example.net/cmd/tool$'
+stdout '^example.net/missing$'
+
+go list -deps example.net/cmd/tool
+
+! go list example.net/missing
+stderr '^no required module provides package example.net/missing; to add it:\n\tgo get example.net/missing$'
+
+
+# https://golang.org/issue/29268
+# 'go get' should fetch modules whose roots contain test-only packages, but
+# without the -t flag shouldn't error out if the test has missing dependencies.
+
+go get -d example.net/testonly@v0.1.0
+
+# With the -t flag, the test dependencies must resolve successfully.
+! go get -d -t example.net/testonly@v0.1.0
+stderr '^example.net/testonly tested by\n\texample.net/testonly\.test imports\n\texample.net/missing: cannot find module providing package example.net/missing$'
+
+
+# 'go get -d' should succeed for a module path that does not contain a package,
+# but fail for a non-package subdirectory of a module.
+
+! go get -d example.net/missing/subdir@v0.1.0
+stderr '^go get: module example.net/missing@v0.1.0 found \(replaced by ./missing\), but does not contain package example.net/missing/subdir$'
+
+go get -d example.net/missing@v0.1.0
+
+
+# Getting the subdirectory should continue to fail even if the corresponding
+# module is already present in the build list.
+
+! go get -d example.net/missing/subdir@v0.1.0
+stderr '^go get: module example.net/missing@v0.1.0 found \(replaced by ./missing\), but does not contain package example.net/missing/subdir$'
+
+
+-- go.mod --
+module example.net/m
+
+go 1.15
+
+replace (
+ example.net/tools v0.1.0 => ./tools
+ example.net/cmd v0.1.0 => ./cmd
+ example.net/testonly v0.1.0 => ./testonly
+ example.net/missing v0.1.0 => ./missing
+)
+
+-- tools/go.mod --
+module example.net/tools
+
+go 1.15
+
+// Requirements intentionally omitted.
+
+-- tools/tools.go --
+// +build tools
+
+package tools
+
+import (
+ _ "example.net/cmd/tool"
+ _ "example.net/missing"
+)
+
+-- cmd/go.mod --
+module example.net/cmd
+
+go 1.16
+-- cmd/tool/tool.go --
+package main
+
+func main() {}
+
+-- testonly/go.mod --
+module example.net/testonly
+
+go 1.15
+-- testonly/testonly_test.go --
+package testonly_test
+
+import _ "example.net/missing"
+
+func Test(t *testing.T) {}
+
+-- missing/go.mod --
+module example.net/missing
+
+go 1.15
+-- missing/README.txt --
+There are no Go source files here.
+-- missing/subdir/README.txt --
+There are no Go source files here either.
From ed8079096fe2e78d6dcb8002758774dca6d24eee Mon Sep 17 00:00:00 2001
From: Cherry Zhang
Date: Wed, 10 Feb 2021 12:43:18 -0500
Subject: [PATCH 06/12] cmd/compile: mark concrete call of
reflect.(*rtype).Method as REFLECTMETHOD
For functions that call reflect.Type.Method (or MethodByName), we
mark it as REFLECTMETHOD, which tells the linker that methods
can be retrieved via reflection and the linker keeps all exported
methods live. Currently, this marking expects exactly the
interface call reflect.Type.Method (or MethodByName). But now the
compiler can devirtualize that call to a concrete call
reflect.(*rtype).Method (or MethodByName), which is not handled
and causing the linker to discard methods too aggressively.
Handle the latter in this CL.
Fixes #44207.
Change-Id: Ia4060472dbff6ab6a83d2ca8e60a3e3f180ee832
Reviewed-on: https://go-review.googlesource.com/c/go/+/290950
Trust: Cherry Zhang
Reviewed-by: Matthew Dempsky
---
src/cmd/compile/internal/gc/walk.go | 16 +++++++++++++++-
test/reflectmethod7.go | 24 ++++++++++++++++++++++++
2 files changed, 39 insertions(+), 1 deletion(-)
create mode 100644 test/reflectmethod7.go
diff --git a/src/cmd/compile/internal/gc/walk.go b/src/cmd/compile/internal/gc/walk.go
index 2133a160b2b..98ebb239917 100644
--- a/src/cmd/compile/internal/gc/walk.go
+++ b/src/cmd/compile/internal/gc/walk.go
@@ -550,8 +550,12 @@ opswitch:
case OCLOSUREVAR, OCFUNC:
case OCALLINTER, OCALLFUNC, OCALLMETH:
- if n.Op == OCALLINTER {
+ if n.Op == OCALLINTER || n.Op == OCALLMETH {
+ // We expect both interface call reflect.Type.Method and concrete
+ // call reflect.(*rtype).Method.
usemethod(n)
+ }
+ if n.Op == OCALLINTER {
markUsedIfaceMethod(n)
}
@@ -3710,6 +3714,16 @@ func usemethod(n *Node) {
}
}
+ // Don't mark reflect.(*rtype).Method, etc. themselves in the reflect package.
+ // Those functions may be alive via the itab, which should not cause all methods
+ // alive. We only want to mark their callers.
+ if myimportpath == "reflect" {
+ switch Curfn.Func.Nname.Sym.Name { // TODO: is there a better way than hardcoding the names?
+ case "(*rtype).Method", "(*rtype).MethodByName", "(*interfaceType).Method", "(*interfaceType).MethodByName":
+ return
+ }
+ }
+
// Note: Don't rely on res0.Type.String() since its formatting depends on multiple factors
// (including global variables such as numImports - was issue #19028).
// Also need to check for reflect package itself (see Issue #38515).
diff --git a/test/reflectmethod7.go b/test/reflectmethod7.go
new file mode 100644
index 00000000000..42429978b45
--- /dev/null
+++ b/test/reflectmethod7.go
@@ -0,0 +1,24 @@
+// run
+
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// See issue 44207.
+
+package main
+
+import "reflect"
+
+type S int
+
+func (s S) M() {}
+
+func main() {
+ t := reflect.TypeOf(S(0))
+ fn, ok := reflect.PtrTo(t).MethodByName("M")
+ if !ok {
+ panic("FAIL")
+ }
+ fn.Func.Call([]reflect.Value{reflect.New(t)})
+}
From e5b08e6d5cecb646066c0cadddf6300e2a10ffb2 Mon Sep 17 00:00:00 2001
From: Russ Cox
Date: Tue, 9 Feb 2021 13:46:53 -0500
Subject: [PATCH 07/12] io/fs: allow backslash in ValidPath, reject in
os.DirFS.Open
Rejecting backslash introduces problems with presenting
underlying OS file systems that contain names with backslash.
Rejecting backslash also does not Windows-proof the syntax,
because colon can also be a path separator. And we are not
going to reject colon from all names. So don't reject backslash
either.
There is a similar problem on Windows with names containing
slashes, but those are more difficult (though not impossible)
to create.
Also document and enforce that paths must be UTF-8.
Fixes #44166.
Change-Id: Iac7a9a268025c1fd31010dbaf3f51e1660c7ae2a
Reviewed-on: https://go-review.googlesource.com/c/go/+/290709
TryBot-Result: Go Bot
Reviewed-by: Bryan C. Mills
Trust: Russ Cox
Run-TryBot: Russ Cox
---
src/io/fs/fs.go | 25 +++++++++++++++----------
src/io/fs/fs_test.go | 7 ++++---
src/os/file.go | 13 ++++++++++++-
src/os/os_test.go | 34 ++++++++++++++++++++++++++++++++++
4 files changed, 65 insertions(+), 14 deletions(-)
diff --git a/src/io/fs/fs.go b/src/io/fs/fs.go
index c330f123ad1..3d2e2ee2ac9 100644
--- a/src/io/fs/fs.go
+++ b/src/io/fs/fs.go
@@ -10,6 +10,7 @@ package fs
import (
"internal/oserror"
"time"
+ "unicode/utf8"
)
// An FS provides access to a hierarchical file system.
@@ -32,15 +33,22 @@ type FS interface {
// ValidPath reports whether the given path name
// is valid for use in a call to Open.
-// Path names passed to open are unrooted, slash-separated
-// sequences of path elements, like “x/y/z”.
-// Path names must not contain a “.” or “..” or empty element,
-// except for the special case that the root directory is named “.”.
-// Leading and trailing slashes (like “/x” or “x/”) are not allowed.
//
-// Paths are slash-separated on all systems, even Windows.
-// Backslashes must not appear in path names.
+// Path names passed to open are UTF-8-encoded,
+// unrooted, slash-separated sequences of path elements, like “x/y/z”.
+// Path names must not contain an element that is “.” or “..” or the empty string,
+// except for the special case that the root directory is named “.”.
+// Paths must not start or end with a slash: “/x” and “x/” are invalid.
+//
+// Note that paths are slash-separated on all systems, even Windows.
+// Paths containing other characters such as backslash and colon
+// are accepted as valid, but those characters must never be
+// interpreted by an FS implementation as path element separators.
func ValidPath(name string) bool {
+ if !utf8.ValidString(name) {
+ return false
+ }
+
if name == "." {
// special case
return true
@@ -50,9 +58,6 @@ func ValidPath(name string) bool {
for {
i := 0
for i < len(name) && name[i] != '/' {
- if name[i] == '\\' {
- return false
- }
i++
}
elem := name[:i]
diff --git a/src/io/fs/fs_test.go b/src/io/fs/fs_test.go
index 8d395fc0db1..aae1a7606f4 100644
--- a/src/io/fs/fs_test.go
+++ b/src/io/fs/fs_test.go
@@ -33,9 +33,10 @@ var isValidPathTests = []struct {
{"x/..", false},
{"x/../y", false},
{"x//y", false},
- {`x\`, false},
- {`x\y`, false},
- {`\x`, false},
+ {`x\`, true},
+ {`x\y`, true},
+ {`x:y`, true},
+ {`\x`, true},
}
func TestValidPath(t *testing.T) {
diff --git a/src/os/file.go b/src/os/file.go
index 416bc0efa62..52dd94339b8 100644
--- a/src/os/file.go
+++ b/src/os/file.go
@@ -620,10 +620,21 @@ func DirFS(dir string) fs.FS {
return dirFS(dir)
}
+func containsAny(s, chars string) bool {
+ for i := 0; i < len(s); i++ {
+ for j := 0; j < len(chars); j++ {
+ if s[i] == chars[j] {
+ return true
+ }
+ }
+ }
+ return false
+}
+
type dirFS string
func (dir dirFS) Open(name string) (fs.File, error) {
- if !fs.ValidPath(name) {
+ if !fs.ValidPath(name) || runtime.GOOS == "windows" && containsAny(name, `\:`) {
return nil, &PathError{Op: "open", Path: name, Err: ErrInvalid}
}
f, err := Open(string(dir) + "/" + name)
diff --git a/src/os/os_test.go b/src/os/os_test.go
index ee54b4aba1a..a32e5fc11ed 100644
--- a/src/os/os_test.go
+++ b/src/os/os_test.go
@@ -2719,6 +2719,40 @@ func TestDirFS(t *testing.T) {
if err := fstest.TestFS(DirFS("./testdata/dirfs"), "a", "b", "dir/x"); err != nil {
t.Fatal(err)
}
+
+ // Test that Open does not accept backslash as separator.
+ d := DirFS(".")
+ _, err := d.Open(`testdata\dirfs`)
+ if err == nil {
+ t.Fatalf(`Open testdata\dirfs succeeded`)
+ }
+}
+
+func TestDirFSPathsValid(t *testing.T) {
+ if runtime.GOOS == "windows" {
+ t.Skipf("skipping on Windows")
+ }
+
+ d := t.TempDir()
+ if err := os.WriteFile(filepath.Join(d, "control.txt"), []byte(string("Hello, world!")), 0644); err != nil {
+ t.Fatal(err)
+ }
+ if err := os.WriteFile(filepath.Join(d, `e:xperi\ment.txt`), []byte(string("Hello, colon and backslash!")), 0644); err != nil {
+ t.Fatal(err)
+ }
+
+ fsys := os.DirFS(d)
+ err := fs.WalkDir(fsys, ".", func(path string, e fs.DirEntry, err error) error {
+ if fs.ValidPath(e.Name()) {
+ t.Logf("%q ok", e.Name())
+ } else {
+ t.Errorf("%q INVALID", e.Name())
+ }
+ return nil
+ })
+ if err != nil {
+ t.Fatal(err)
+ }
}
func TestReadFileProc(t *testing.T) {
From 930c2c9a6810b54d84dc499120219a6cb4563fd7 Mon Sep 17 00:00:00 2001
From: Russ Cox
Date: Tue, 9 Feb 2021 17:34:09 -0500
Subject: [PATCH 08/12] cmd/go: reject embedded files that can't be packed into
modules
If the file won't be packed into a module,
don't put those files into embeds.
Otherwise people will be surprised when things work
locally but not when imported by another module.
Observed on CL 290709
Change-Id: Ia0ef7d0e0f5e42473c2b774e57c843e68a365bc7
Reviewed-on: https://go-review.googlesource.com/c/go/+/290809
Trust: Russ Cox
Run-TryBot: Russ Cox
TryBot-Result: Go Bot
Reviewed-by: Bryan C. Mills
Reviewed-by: Jay Conrod
---
src/cmd/go/internal/load/pkg.go | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go
index 3a274a3ad13..8b12faf4cd2 100644
--- a/src/cmd/go/internal/load/pkg.go
+++ b/src/cmd/go/internal/load/pkg.go
@@ -36,6 +36,8 @@ import (
"cmd/go/internal/str"
"cmd/go/internal/trace"
"cmd/internal/sys"
+
+ "golang.org/x/mod/module"
)
var IgnoreImports bool // control whether we ignore imports in packages
@@ -2090,6 +2092,9 @@ func validEmbedPattern(pattern string) bool {
// can't or won't be included in modules and therefore shouldn't be treated
// as existing for embedding.
func isBadEmbedName(name string) bool {
+ if err := module.CheckFilePath(name); err != nil {
+ return true
+ }
switch name {
// Empty string should be impossible but make it bad.
case "":
From 26ceae85a89dc4ea910cc0bfa209c85213a93725 Mon Sep 17 00:00:00 2001
From: DQNEO
Date: Wed, 10 Feb 2021 14:46:54 +0900
Subject: [PATCH 09/12] spec: More precise wording in section on function
calls.
A caller is not always in a function.
For example, a call can appear in top level declarations.
e.g. var x = f()
Change-Id: I29c4c3b7663249434fb2b8a6d0003267c77268cf
Reviewed-on: https://go-review.googlesource.com/c/go/+/290849
Reviewed-by: Rob Pike
Reviewed-by: Ian Lance Taylor
Reviewed-by: Robert Griesemer
Trust: Robert Griesemer
---
doc/go_spec.html | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/doc/go_spec.html b/doc/go_spec.html
index c9e14a3fec7..59c9ce3c434 100644
--- a/doc/go_spec.html
+++ b/doc/go_spec.html
@@ -1,6 +1,6 @@
@@ -3446,7 +3446,7 @@ In a function call, the function value and arguments are evaluated in
After they are evaluated, the parameters of the call are passed by value to the function
and the called function begins execution.
The return parameters of the function are passed by value
-back to the calling function when the function returns.
+back to the caller when the function returns.
From 864d4f1c6b364e13c0a4008bc203f336b0027f44 Mon Sep 17 00:00:00 2001
From: Jay Conrod
Date: Thu, 11 Feb 2021 10:27:55 -0500
Subject: [PATCH 10/12] cmd/go: multiple small 'go help' fixes
* Link to privacy policies for proxy.golang.org and sum.golang.org in
'go help modules'. It's important that both policies are linked from
the go command's documentation.
* Fix wording and typo in 'go help vcs' following comments in CL 290992,
which adds reference documentation for GOVCS.
* Fix whitespace on GOVCS in 'go help environment'.
For #41730
Change-Id: I86abceacd4962b748361244026f219157c9285e9
Reviewed-on: https://go-review.googlesource.com/c/go/+/291230
Trust: Jay Conrod
Run-TryBot: Jay Conrod
Reviewed-by: Bryan C. Mills
TryBot-Result: Go Bot
---
src/cmd/go/alldocs.go | 30 +++++++++++++++++++++--------
src/cmd/go/internal/help/helpdoc.go | 2 +-
src/cmd/go/internal/modget/get.go | 17 +++++++++-------
src/cmd/go/internal/modload/help.go | 13 +++++++++++--
4 files changed, 44 insertions(+), 18 deletions(-)
diff --git a/src/cmd/go/alldocs.go b/src/cmd/go/alldocs.go
index 49d390297cd..e7c63f0749d 100644
--- a/src/cmd/go/alldocs.go
+++ b/src/cmd/go/alldocs.go
@@ -1808,7 +1808,7 @@
// The directory where the go command will write
// temporary source files, packages, and binaries.
// GOVCS
-// Lists version control commands that may be used with matching servers.
+// Lists version control commands that may be used with matching servers.
// See 'go help vcs'.
//
// Environment variables for use with cgo:
@@ -2410,6 +2410,17 @@
//
// For a detailed reference on modules, see https://golang.org/ref/mod.
//
+// By default, the go command may download modules from https://proxy.golang.org.
+// It may authenticate modules using the checksum database at
+// https://sum.golang.org. Both services are operated by the Go team at Google.
+// The privacy policies for these services are available at
+// https://proxy.golang.org/privacy and https://sum.golang.org/privacy,
+// respectively.
+//
+// The go command's download behavior may be configured using GOPROXY, GOSUMDB,
+// GOPRIVATE, and other environment variables. See 'go help environment'
+// and https://golang.org/ref/mod#private-module-privacy for more information.
+//
//
// Module authentication using go.sum
//
@@ -2868,20 +2879,23 @@
// legal reasons). Therefore, clients can still access public code served from
// Bazaar, Fossil, or Subversion repositories by default, because those downloads
// use the Go module mirror, which takes on the security risk of running the
-// version control commands, using a custom sandbox.
+// version control commands using a custom sandbox.
//
// The GOVCS variable can be used to change the allowed version control systems
// for specific packages (identified by a module or import path).
-// The GOVCS variable applies both when using modules and when using GOPATH.
-// When using modules, the patterns match against the module path.
-// When using GOPATH, the patterns match against the import path
-// corresponding to the root of the version control repository.
+// The GOVCS variable applies when building package in both module-aware mode
+// and GOPATH mode. When using modules, the patterns match against the module path.
+// When using GOPATH, the patterns match against the import path corresponding to
+// the root of the version control repository.
//
// The general form of the GOVCS setting is a comma-separated list of
// pattern:vcslist rules. The pattern is a glob pattern that must match
// one or more leading elements of the module or import path. The vcslist
// is a pipe-separated list of allowed version control commands, or "all"
-// to allow use of any known command, or "off" to allow nothing.
+// to allow use of any known command, or "off" to disallow all commands.
+// Note that if a module matches a pattern with vcslist "off", it may still be
+// downloaded if the origin server uses the "mod" scheme, which instructs the
+// go command to download the module using the GOPROXY protocol.
// The earliest matching pattern in the list applies, even if later patterns
// might also match.
//
@@ -2889,7 +2903,7 @@
//
// GOVCS=github.com:git,evil.com:off,*:git|hg
//
-// With this setting, code with an module or import path beginning with
+// With this setting, code with a module or import path beginning with
// github.com/ can only use git; paths on evil.com cannot use any version
// control command, and all other paths (* matches everything) can use
// only git or hg.
diff --git a/src/cmd/go/internal/help/helpdoc.go b/src/cmd/go/internal/help/helpdoc.go
index e07ad0e1db1..57cee4ff96c 100644
--- a/src/cmd/go/internal/help/helpdoc.go
+++ b/src/cmd/go/internal/help/helpdoc.go
@@ -542,7 +542,7 @@ General-purpose environment variables:
The directory where the go command will write
temporary source files, packages, and binaries.
GOVCS
- Lists version control commands that may be used with matching servers.
+ Lists version control commands that may be used with matching servers.
See 'go help vcs'.
Environment variables for use with cgo:
diff --git a/src/cmd/go/internal/modget/get.go b/src/cmd/go/internal/modget/get.go
index 1a8c9d37255..dccacd3d1ee 100644
--- a/src/cmd/go/internal/modget/get.go
+++ b/src/cmd/go/internal/modget/get.go
@@ -176,20 +176,23 @@ packages or when the mirror refuses to serve a public package (typically for
legal reasons). Therefore, clients can still access public code served from
Bazaar, Fossil, or Subversion repositories by default, because those downloads
use the Go module mirror, which takes on the security risk of running the
-version control commands, using a custom sandbox.
+version control commands using a custom sandbox.
The GOVCS variable can be used to change the allowed version control systems
for specific packages (identified by a module or import path).
-The GOVCS variable applies both when using modules and when using GOPATH.
-When using modules, the patterns match against the module path.
-When using GOPATH, the patterns match against the import path
-corresponding to the root of the version control repository.
+The GOVCS variable applies when building package in both module-aware mode
+and GOPATH mode. When using modules, the patterns match against the module path.
+When using GOPATH, the patterns match against the import path corresponding to
+the root of the version control repository.
The general form of the GOVCS setting is a comma-separated list of
pattern:vcslist rules. The pattern is a glob pattern that must match
one or more leading elements of the module or import path. The vcslist
is a pipe-separated list of allowed version control commands, or "all"
-to allow use of any known command, or "off" to allow nothing.
+to allow use of any known command, or "off" to disallow all commands.
+Note that if a module matches a pattern with vcslist "off", it may still be
+downloaded if the origin server uses the "mod" scheme, which instructs the
+go command to download the module using the GOPROXY protocol.
The earliest matching pattern in the list applies, even if later patterns
might also match.
@@ -197,7 +200,7 @@ For example, consider:
GOVCS=github.com:git,evil.com:off,*:git|hg
-With this setting, code with an module or import path beginning with
+With this setting, code with a module or import path beginning with
github.com/ can only use git; paths on evil.com cannot use any version
control command, and all other paths (* matches everything) can use
only git or hg.
diff --git a/src/cmd/go/internal/modload/help.go b/src/cmd/go/internal/modload/help.go
index 1cb58961bed..fd39ddd94ec 100644
--- a/src/cmd/go/internal/modload/help.go
+++ b/src/cmd/go/internal/modload/help.go
@@ -6,8 +6,6 @@ package modload
import "cmd/go/internal/base"
-// TODO(rsc): The "module code layout" section needs to be written.
-
var HelpModules = &base.Command{
UsageLine: "modules",
Short: "modules, module versions, and more",
@@ -22,6 +20,17 @@ For a series of tutorials on modules, see
https://golang.org/doc/tutorial/create-module.
For a detailed reference on modules, see https://golang.org/ref/mod.
+
+By default, the go command may download modules from https://proxy.golang.org.
+It may authenticate modules using the checksum database at
+https://sum.golang.org. Both services are operated by the Go team at Google.
+The privacy policies for these services are available at
+https://proxy.golang.org/privacy and https://sum.golang.org/privacy,
+respectively.
+
+The go command's download behavior may be configured using GOPROXY, GOSUMDB,
+GOPRIVATE, and other environment variables. See 'go help environment'
+and https://golang.org/ref/mod#private-module-privacy for more information.
`,
}
From 249da7ec020e194208c02c8eb6a04d017bf29fea Mon Sep 17 00:00:00 2001
From: Carlos Amedee
Date: Wed, 10 Feb 2021 20:29:50 -0500
Subject: [PATCH 11/12] CONTRIBUTORS: update for the Go 1.16 release
This update was created using the updatecontrib command:
go get golang.org/x/build/cmd/updatecontrib
cd gotip
updatecontrib
With manual changes based on publicly available information
to canonicalize letter case and formatting for a few names.
For #12042.
Change-Id: I030b77e8ebcc7fe02106f0f264acdfb0b56e20d9
Reviewed-on: https://go-review.googlesource.com/c/go/+/291189
Trust: Carlos Amedee
Run-TryBot: Carlos Amedee
TryBot-Result: Go Bot
Reviewed-by: Ian Lance Taylor
Reviewed-by: Alexander Rakoczy
Reviewed-by: Dmitri Shuralyov
---
CONTRIBUTORS | 158 +++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 158 insertions(+)
diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index cebc92f53f8..ccbe4627f38 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -30,6 +30,7 @@ Aaron Bieber
Aaron Cannon
Aaron France
Aaron Jacobs
+Aaron Jensen
Aaron Kemp
Aaron Patterson
Aaron Stein
@@ -71,9 +72,11 @@ Ahmet Alp Balkan
Ahmet Soormally
Ahmy Yulrizka
Ahsun Ahmed
+Aidan Coyle
Aiden Scandella
Ainar Garipov
Aishraj Dahal
+Ajanthan Balachandran
Akhil Indurti
Akihiro Suda
Akshat Kumar
@@ -104,9 +107,11 @@ Alex Buchanan
Alex Carol
Alex Gaynor
Alex Harford
+Alex Hays
Alex Jin
Alex Kohler
Alex Myasoedov
+Alex Opie
Alex Plugaru
Alex Schroeder
Alex Sergeyev
@@ -119,6 +124,7 @@ Alexander F Rødseth
Alexander Greim
Alexander Guz
Alexander Kauer
+Alexander Klauer
Alexander Kucherenko
Alexander Larsson
Alexander Lourier
@@ -150,16 +156,19 @@ Alexey Naidonov
Alexey Neganov
Alexey Palazhchenko
Alexey Semenyuk
+Alexey Vilenskiy
Alexis Hildebrandt
Alexis Hunt
Alexis Imperial-Legrand
Ali Farooq
Ali Rizvi-Santiago
Aliaksandr Valialkin
+Alice Merrick
Alif Rachmawadi
Allan Simon
Allen Li
Alok Menghrajani
+Alwin Doss
Aman Gupta
Amarjeet Anand
Amir Mohammad Saied
@@ -168,6 +177,8 @@ Amrut Joshi
An Long
An Xiao
Anand K. Mistry
+Ananya Saxena
+Anatol Pomozov
Anders Pearson
Anderson Queiroz
André Carvalho
@@ -199,6 +210,7 @@ Andrew G. Morgan
Andrew Gerrand
Andrew Harding
Andrew Jackura
+Andrew Kemm
Andrew Louis
Andrew Lutomirski
Andrew Medvedev
@@ -216,6 +228,7 @@ Andrew Werner
Andrew Wilkins
Andrew Williams
Andrew Z Allen
+Andrey Bokhanko
Andrey Mirtchovski
Andrey Petrov
Andrii Soldatenko
@@ -230,6 +243,7 @@ Andy Maloney
Andy Pan
Andy Walker
Andy Wang
+Andy Williams
Andzej Maciusovic
Anfernee Yongkun Gui
Angelo Bulfone
@@ -274,6 +288,7 @@ Arne Hormann
Arnout Engelen
Aron Nopanen
Artem Alekseev
+Artem Khvastunov
Artem Kolin
Arthur Fabre
Arthur Khashaev
@@ -281,8 +296,10 @@ Artyom Pervukhin
Arvindh Rajesh Tamilmani
Ashish Gandhi
Asim Shankar
+Assel Meher
Atin Malaviya
Ato Araki
+Atsushi Toyama
Audrey Lim
Audrius Butkevicius
Augusto Roman
@@ -291,6 +308,7 @@ Aurélien Rainone
Aurélio A. Heckert
Austin Clements
Avi Flax
+Aviv Klasquin Komissar
awaw fumin
Awn Umar
Axel Wagner
@@ -298,6 +316,7 @@ Ayan George
Ayanamist Yang
Ayke van Laethem
Aymerick Jéhanne
+Ayzat Sadykov
Azat Kaumov
Baiju Muthukadan
Balaram Makam
@@ -308,10 +327,12 @@ Bartosz Grzybowski
Bartosz Oler
Bastian Ike
Ben Burkert
+Ben Cartwright-Cox
Ben Eitzen
Ben Fried
Ben Haines
Ben Hoyt
+Ben Kraft
Ben Laurie
Ben Lubar
Ben Lynn
@@ -319,6 +340,7 @@ Ben Olive
Ben Schwartz
Ben Shi
Ben Toews
+Benjamin Barenblat
Benjamin Black
Benjamin Cable
Benjamin Hsieh
@@ -356,6 +378,7 @@ Bobby Powers
Boqin Qin
Boris Nagaev
Borja Clemente
+Boshi Lian
Brad Burch
Brad Erickson
Brad Fitzpatrick
@@ -368,10 +391,12 @@ Bradford Lamson-Scribner
Bradley Falzon
Brady Catherman
Brady Sullivan
+Branden J. Brown
Brandon Bennett
Brandon Gilmore
Brandon Philips
Brandon Ryan
+Brave Cow
Brayden Cloud
Brendan Daniel Tracey
Brendan O'Dea
@@ -389,6 +414,7 @@ Brian Slesinsky
Brian Smith
Brian Starke
Bryan Alexander
+Bryan Boreham
Bryan C. Mills
Bryan Chan
Bryan Ford
@@ -407,6 +433,7 @@ Carl Mastrangelo
Carl Shapiro
Carlisia Campos
Carlo Alberto Ferraris
+Carlos Alexandro Becker
Carlos Amedee
Carlos Castillo
Carlos Cirello
@@ -422,6 +449,7 @@ Casey Callendrello
Casey Marshall
Catalin Nicutar
Catalin Patulea
+Cathal O'Callaghan
Cedric Staub
Cezar Sá Espinola
Chad Rosier
@@ -434,10 +462,14 @@ Charles Kenney
Charles L. Dorian
Charles Lee
Charles Weill
+Charlotte Brandhorst-Satzkorn
Chauncy Cullitan
+Chen Zhidong
Chen Zhihan
Cherry Zhang
Chew Choon Keat
+Chiawen Chen
+Chirag Sukhala
Cholerae Hu
Chotepud Teo
Chris Ball
@@ -460,6 +492,8 @@ Chris Raynor
Chris Roche
Chris Smith
Chris Stockton
+Chris Taylor
+Chris Waldon
Chris Zou
Christian Alexander
Christian Couder
@@ -467,6 +501,7 @@ Christian Himpel
Christian Muehlhaeuser
Christian Pellegrin
Christian R. Petrin
+Christian Svensson
Christine Hansmann
Christoffer Buchholz
Christoph Blecker
@@ -474,6 +509,7 @@ Christoph Hack
Christopher Cahoon
Christopher Guiney
Christopher Henderson
+Christopher Hlubek
Christopher Koch
Christopher Loessl
Christopher Nelson