diff options
author | Bryan C. Mills <bcmills@google.com> | 2018-12-04 17:00:19 -0500 |
---|---|---|
committer | Bryan C. Mills <bcmills@google.com> | 2018-12-07 14:48:24 +0000 |
commit | 9a8006764336b71cd28ff313db1558865e6afc47 (patch) | |
tree | 0fe3502d9c97df6f3aa28d97532bf0ef234d0348 | |
parent | aaa5f477540e6ef89de0da858a1334d05344d7fc (diff) | |
download | go-9a8006764336b71cd28ff313db1558865e6afc47.tar.gz go-9a8006764336b71cd28ff313db1558865e6afc47.zip |
[release-branch.go1.10-security] cmd/go/internal/get: relax pathOK check to allow any letter
This fixes a regression of #18660 with the new path checks.
Change-Id: I07cd248392ba8f5f9b1614b79a323cca1ad1d46d
Reviewed-on: https://team-review.git.corp.google.com/c/372708
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
-rw-r--r-- | src/cmd/go/internal/get/path.go | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/src/cmd/go/internal/get/path.go b/src/cmd/go/internal/get/path.go index c8072b25fd..d443bd28a9 100644 --- a/src/cmd/go/internal/get/path.go +++ b/src/cmd/go/internal/get/path.go @@ -12,10 +12,13 @@ import ( ) // The following functions are copied verbatim from cmd/go/internal/module/module.go, -// with one change to additionally reject Windows short-names. +// with a change to additionally reject Windows short-names, +// and one to accept arbitrary letters (golang.org/issue/29101). // // TODO(bcmills): After the call site for this function is backported, // consolidate this back down to a single copy. +// +// NOTE: DO NOT MERGE THESE UNTIL WE DECIDE ABOUT ARBITRARY LETTERS IN MODULE MODE. // CheckImportPath checks that an import path is valid. func CheckImportPath(path string) error { @@ -120,10 +123,8 @@ func checkElem(elem string, fileName bool) error { } // pathOK reports whether r can appear in an import path element. -// Paths can be ASCII letters, ASCII digits, and limited ASCII punctuation: + - . _ and ~. -// This matches what "go get" has historically recognized in import paths. -// TODO(rsc): We would like to allow Unicode letters, but that requires additional -// care in the safe encoding (see note below). +// +// NOTE: This function DIVERGES from module mode pathOK by accepting Unicode letters. func pathOK(r rune) bool { if r < utf8.RuneSelf { return r == '+' || r == '-' || r == '.' || r == '_' || r == '~' || @@ -131,7 +132,7 @@ func pathOK(r rune) bool { 'A' <= r && r <= 'Z' || 'a' <= r && r <= 'z' } - return false + return unicode.IsLetter(r) } // fileNameOK reports whether r can appear in a file name. |