diff options
| author | Bryan C. Mills <bcmills@google.com> | 2018-12-04 15:42:32 -0500 |
|---|---|---|
| committer | Bryan C. Mills <bcmills@google.com> | 2018-12-07 14:48:05 +0000 |
| commit | aaa5f477540e6ef89de0da858a1334d05344d7fc (patch) | |
| tree | b063e79433eac7ac59d0bff3e3d1757b3fb14c86 | |
| parent | 7ef6ee2c5727f0d11206b4d1866c18e6ab4785be (diff) | |
| download | go-aaa5f477540e6ef89de0da858a1334d05344d7fc.tar.gz go-aaa5f477540e6ef89de0da858a1334d05344d7fc.zip | |
[release-branch.go1.10-security] cmd/go/internal/get: use a strings.Replacer in expand
This should be a no-op, but produces deterministic (and more correct)
behavior if we have accidentally failed to sanitize one of the inputs.
Change-Id: I1271d0ffd01a691ec8c84906c4e02d9e2be19c72
Reviewed-on: https://team-review.git.corp.google.com/c/372707
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
| -rw-r--r-- | src/cmd/go/internal/get/vcs.go | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/cmd/go/internal/get/vcs.go b/src/cmd/go/internal/get/vcs.go index 0b2a04e04f..58d8035416 100644 --- a/src/cmd/go/internal/get/vcs.go +++ b/src/cmd/go/internal/get/vcs.go @@ -970,10 +970,14 @@ func matchGoImport(imports []metaImport, importPath string) (metaImport, error) // expand rewrites s to replace {k} with match[k] for each key k in match. func expand(match map[string]string, s string) string { + // We want to replace each match exactly once, and the result of expansion + // must not depend on the iteration order through the map. + // A strings.Replacer has exactly the properties we're looking for. + oldNew := make([]string, 0, 2*len(match)) for k, v := range match { - s = strings.Replace(s, "{"+k+"}", v, -1) + oldNew = append(oldNew, "{"+k+"}", v) } - return s + return strings.NewReplacer(oldNew...).Replace(s) } // vcsPaths defines the meaning of import paths referring to |