1
0
mirror of https://github.com/golang/go synced 2024-11-07 11:56:17 -07:00
The Go programming language
Go to file
Russ Cox 5c622a5bf3 cmd/go/internal/modfetch: restrict file names in zip files, avoid case-insensitive collisions
Within the zip file for a given module, disallow names that are invalid
on various operating systems (mostly Windows), and disallow
having two different paths that are case-fold-equivalent.
Disallowing different case-fold-equivalent paths means the
zip file content is safe for case-insensitive file systems.

There is more we could do to relax the rules later, but I think
this should be enough to avoid digging a hole in the early days
of modules that's hard to climb out of later.

In tests on my repo test corpus, the repos now rejected are:

github.com/vjeantet/goldap v0.0.0-20160521203625-ea702ca12a40
	"doc/RFC 4511 - LDAP: The Protocol.txt": invalid char ':'

github.com/ChimeraCoder/anaconda v0.0.0-20160509014622-91bfbf5de08d
	"json/statuses/show.json?id=404409873170841600": invalid char '?'

github.com/bmatcuk/doublestar
	"test/a☺b": invalid char '☺'

github.com/kubernetes-incubator/service-catalog v0.1.10
	"cmd/svcat/testdata/responses/clusterserviceclasses?fieldSelector=spec.externalName=user-provided-service.json": invalid char '?'

The : and ? are reserved on Windows,
and the : is half-reserved (and quite confusing) on macOS.
The ☺ is perhaps an overreach, but I am not convinced
that allowing all of category So is safe; certainly Sk is not.

Change-Id: I83b6ac47ce6c442f726f1036bccccdb15553c0af
Reviewed-on: https://go-review.googlesource.com/124380
Run-TryBot: Russ Cox <rsc@golang.org>
Reviewed-by: Bryan C. Mills <bcmills@google.com>
2018-07-18 02:08:59 +00:00
.github .github: use HTTPS for Stack Overflow link in SUPPORT.md 2018-06-12 11:08:14 +00:00
api syscall: convert Windows AddrinfoW.Addr from uintptr to syscall.Pointer 2018-07-12 15:36:15 +00:00
doc doc: improve the garbage collection discussion 2018-07-17 22:02:35 +00:00
lib/time lib/time: update vendored tzdata to release 2018e 2018-06-11 14:47:06 +00:00
misc cmd/cgo: update JNI's jobject to uintptr check for newer Android NDKs 2018-07-17 16:51:15 +00:00
src cmd/go/internal/modfetch: restrict file names in zip files, avoid case-insensitive collisions 2018-07-18 02:08:59 +00:00
test cmd/compile: keep autos if their address reaches a control value 2018-07-17 14:58:54 +00:00
.gitattributes
.gitignore
AUTHORS A+C: add additional email address 2018-07-06 02:04:28 +00:00
CONTRIBUTING.md all: restore changes from faulty merge/revert 2018-02-12 20:13:59 +00:00
CONTRIBUTORS CONTRIBUTORS: replace old e-mail address 2018-07-06 09:33:50 +00:00
favicon.ico
LICENSE
PATENTS
README.md README: linkify some paths 2018-06-06 18:07:01 +00:00
robots.txt

The Go Programming Language

Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.

Gopher image Gopher image by Renee French, licensed under Creative Commons 3.0 Attributions license.

Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.

Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.

Download and Install

Binary Distributions

Official binary distributions are available at https://golang.org/dl/.

After downloading a binary release, visit https://golang.org/doc/install or load doc/install.html in your web browser for installation instructions.

Install From Source

If a binary distribution is not available for your combination of operating system and architecture, visit https://golang.org/doc/install/source or load doc/install-source.html in your web browser for source installation instructions.

Contributing

Go is the work of thousands of contributors. We appreciate your help!

To contribute, please read the contribution guidelines: https://golang.org/doc/contribute.html

Note that the Go project uses the issue tracker for bug reports and proposals only. See https://golang.org/wiki/Questions for a list of places to ask questions about the Go language.