aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-09-25[release-branch.go1.13-security] go1.13.1go1.13.1Filippo Valsorda
Change-Id: I371ff39537fc617a2462cc947dd717b53ede7bcc Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/558790 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2019-09-25[release-branch.go1.13-security] doc: add Go 1.13 to release historyAndrew
Change-Id: I3340561c0b17bf28d8d480e00f5bc8afb2a897ef Reviewed-on: https://go-review.googlesource.com/c/go/+/193042 Run-TryBot: Andrew Bonventre <andybons@golang.org> Reviewed-by: Katie Hockman <katie@golang.org> Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/558786 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2019-09-25[release-branch.go1.13-security] net/textproto: don't normalize headers with ↵Filippo Valsorda
spaces before the colon RFC 7230 is clear about headers with a space before the colon, like X-Answer : 42 being invalid, but we've been accepting and normalizing them for compatibility purposes since CL 5690059 in 2012. On the client side, this is harmless and indeed most browsers behave the same to this day. On the server side, this becomes a security issue when the behavior doesn't match that of a reverse proxy sitting in front of the server. For example, if a WAF accepts them without normalizing them, it might be possible to bypass its filters, because the Go server would interpret the header differently. Worse, if the reverse proxy coalesces requests onto a single HTTP/1.1 connection to a Go server, the understanding of the request boundaries can get out of sync between them, allowing an attacker to tack an arbitrary method and path onto a request by other clients, including authentication headers unknown to the attacker. This was recently presented at multiple security conferences: https://portswigger.net/blog/http-desync-attacks-request-smuggling-reborn net/http servers already reject header keys with invalid characters. Simply stop normalizing extra spaces in net/textproto, let it return them unchanged like it does for other invalid headers, and let net/http enforce RFC 7230, which is HTTP specific. This loses us normalization on the client side, but there's no right answer on the client side anyway, and hiding the issue sounds worse than letting the application decide. Fixes CVE-2019-16276 Change-Id: I6d272de827e0870da85d93df770d6a0e161bbcf1 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/549719 Reviewed-by: Brad Fitzpatrick <bradfitz@google.com> (cherry picked from commit 1280b868e82bf173ea3e988be3092d160ee66082) Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/558935 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2019-09-25[release-branch.go1.13-security] doc: document Go 1.13.1 and Go 1.12.10Filippo Valsorda
Change-Id: If694ce529393b8ae9c6c55270665efc3a108a3b2 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/558783 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2019-09-03[release-branch.go1.13] go1.13go1.13Andrew Bonventre
Change-Id: Iad80da6df9a6f9a39458e1060bed3557a5ed89a4 Reviewed-on: https://go-review.googlesource.com/c/go/+/193037 Run-TryBot: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com> Reviewed-by: Alexander Rakoczy <alex@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Andrew Bonventre <andybons@golang.org>
2019-09-03[release-branch.go1.13] doc/go1.13: remove announcements of arm64 support on ↵Bryan C. Mills
NetBSD and OpenBSD Those configurations currently lack builders, and it is not clear to me what state their tests are in. The Go porting policy¹ requires builders for all active ports, so let's not claim support until that requirement is met. ¹https://golang.org/wiki/PortingPolicy#requirements-for-a-new-port Updates #30824 Updates #31656 Updates #34035 Updates #34036 Change-Id: I6496de9d92fb8546048abf139cf10546a47e314b Reviewed-on: https://go-review.googlesource.com/c/go/+/192997 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> (cherry picked from commit 9f5127bfebfc8c3acec4dbb374ff5c0d4c586565) Reviewed-on: https://go-review.googlesource.com/c/go/+/192998 Run-TryBot: Bryan C. Mills <bcmills@google.com>
2019-09-03[release-branch.go1.13] os: skip TestPipeThreads on GOOS=darwinEmmanuel Odeke
Updates #32326. Updates #33953. Change-Id: I97a1cbe682becfe9592e19294d4d94f5e5b16c21 Reviewed-on: https://go-review.googlesource.com/c/go/+/192342 Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org> (cherry picked from commit bac5b3f0fe7838ecf6e206fa8d2123c7771eb976) Reviewed-on: https://go-review.googlesource.com/c/go/+/192757 Run-TryBot: Andrew Bonventre <andybons@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2019-09-02[release-branch.go1.13] net/http: make docs refer to Context.Value as a ↵Kevin Gillette
getter instead of context.WithValue The doc comments of both ServerContextKey and LocalAddrContextKey both suggest that context.WithValue can be used to access (get) properties of the server or connection. This PR fixes those comments to refer to Context.Value instead. Change-Id: I4ed383ef97ba1951f90c555243007469cfc18d4d GitHub-Last-Rev: 05bc3acf82322e3dc77abc7fa0412efe01a77eac GitHub-Pull-Request: golang/go#33833 Reviewed-on: https://go-review.googlesource.com/c/go/+/191838 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> (cherry picked from commit 8b03a3992bc755eadbccc10d97adc21d0b229401) Reviewed-on: https://go-review.googlesource.com/c/go/+/191750 Reviewed-by: Andrew Bonventre <andybons@golang.org> Run-TryBot: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-09-02[release-branch.go1.13] doc: document Go 1.13Andrew
Change-Id: Icf7e1dab82aa48cc693eb4da8a564dff23312741 Reviewed-on: https://go-review.googlesource.com/c/go/+/192746 Run-TryBot: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2019-09-02[release-branch.go1.13] doc/1.13: remove draft note and make various fixesAndrew Bonventre
Updates #33954 Change-Id: Idfe71bf825adcd7cbf70cd139b3e779963394ff6 Reviewed-on: https://go-review.googlesource.com/c/go/+/192105 Run-TryBot: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Katie Hockman <katie@golang.org> (cherry picked from commit dec16794cf9136f8887e08391c01f1265b876ddb) Reviewed-on: https://go-review.googlesource.com/c/go/+/192743 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2019-09-02[release-branch.go1.13] encoding/json: revert Compact HTML escaping ↵Tom Thorogood
documentation This partly reverts CL 173417 as it incorrectly documented that Compact performed HTML escaping and the output was safe to embed inside HTML <script> tags. This has never been true. Although Compact does escape U+2028 and U+2029, it doesn't escape <, > or &. Compact is thus only performing a subset of HTML escaping and it's output is not safe to embed inside HTML <script> tags. A more complete fix would be for Compact to either never perform any HTML escaping, as it was prior to CL 10883045, or to actually perform the same HTML escaping as HTMLEscape. Neither change is likely safe enough for go1.13. Fixes #34006 Updates #30357 Change-Id: I912f0fe9611097d988048b28228c4a5b985080ba GitHub-Last-Rev: aebababc9233c5705785b225377e80096d4bb8c4 GitHub-Pull-Request: golang/go#33427 Reviewed-on: https://go-review.googlesource.com/c/go/+/188717 Reviewed-by: Daniel Martí <mvdan@mvdan.cc> Run-TryBot: Daniel Martí <mvdan@mvdan.cc> TryBot-Result: Gobot Gobot <gobot@golang.org> (cherry picked from commit 79669dc705aa8fcddc8f9407c568e4317d619dfe) Reviewed-on: https://go-review.googlesource.com/c/go/+/192747 Reviewed-by: Andrew Bonventre <andybons@golang.org> Run-TryBot: Andrew Bonventre <andybons@golang.org>
2019-08-29[release-branch.go1.13] go1.13rc2go1.13rc2Andrew Bonventre
Change-Id: I1d3f2f7e8d274f328e20f9158468d8a1b4367fcf Reviewed-on: https://go-review.googlesource.com/c/go/+/192320 Run-TryBot: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com>
2019-08-28[release-branch.go1.13] CONTRIBUTORS: second round of updates for Go 1.13Dmitri Shuralyov
This update has been automatically generated using the updatecontrib command: cd gotip go run golang.org/x/build/cmd/updatecontrib With minor manual changes based on publicly available information to canonicalize letter case for a few names. Actions taken (relative to CONTRIBUTORS at origin/master): Added Albert Teoh <albert.teoh@gmail.com> Added Allen Li <ayatane@google.com> Added Anderson Queiroz <contato@andersonq.eti.br> Added Andrew Todd <andrew.todd@wework.com> Added Artem Kolin <artemkaxboy@gmail.com> Added Bharath Thiruveedula <tbharath91@gmail.com> Added Christian Muehlhaeuser <muesli@gmail.com> Added Darren McCleary <darren.rmc@gmail.com> Added David Finkel <david.finkel@gmail.com> Added Eddie Scholtz <escholtz@google.com> Added GitHub User tatsumack (4510569) <tatsu.mack@gmail.com> Added GitHub User utkarsh-extc (53217283) <53217283+utkarsh-extc@users.noreply.github.com> Added GitHub User yuanhh (1298735) <yuan415030@gmail.com> Added Illya Yalovyy <yalovoy@gmail.com> Added James Eady <jmeady@google.com> Added Jan Steinke <jan.steinke@gmail.com> Added Javier Revillas <jrevillas@massivedynamic.io> Added Jordi Martin <jordimartin@gmail.com> Added Jorge Araya <jorgejavieran@yahoo.com.mx> Added Kelly Heller <pestophagous@gmail.com> Added Kevin Gillette <extemporalgenome@gmail.com> Added Mark Glines <mark@glines.org> Added Nao Yonashiro <owan.orisano@gmail.com> Added Pascal Dierich <pascal@pascaldierich.com> Added Pure White <wu.purewhite@gmail.com> Added Sam Arnold <sarnold64@bloomberg.net> Added Sander van Harmelen <sander@vanharmelen.nl> Added Sergei Zagurskii <gvozdoder@gmail.com> Added Shivani Singhal <shivani.singhal2804@gmail.com> Added Stefan Baebler <sbaebler@outbrain.com> Added Tianon Gravi <admwiggin@gmail.com> Added Toshihiro Shiino <shiino.toshihiro@gmail.com> Added Wagner Riffel <wgrriffel@gmail.com> Used GitHub User tatsumack (4510569) form for tatsumack <tatsu.mack@gmail.com> https://github.com/golang/website/commit/7eeb7ef [website] Used GitHub User utkarsh-extc (53217283) form for utkarsh-extc <53217283+utkarsh-extc@users.noreply.github.com> https://github.com/golang/sys/commit/51ab0e2 [sys] Used GitHub User yuanhh (1298735) form for yuanhh <yuan415030@gmail.com> https://github.com/golang/crypto/commit/60c769a [crypto] Used GitHub name "Akhil Indurti" for smasher164 <aindurti@gmail.com> https://github.com/golang/go/commit/5ca44dc403 [build exp go sys] Used GitHub name "Artem Kolin" for artemkaxboy <artemkaxboy@gmail.com> https://github.com/golang/go/commit/e881604d1c [go] Used GitHub name "Ivan Markin" for nogoegst <nogoegst@users.noreply.github.com> https://github.com/golang/go/commit/a1addf15df [go] Used GitHub name "Keiji Yoshida" for yosssi <yoshida.keiji.84@gmail.com> https://github.com/golang/lint/commit/ac6833c [lint] Used GitHub name "Michalis Kargakis" for kargakis <mkargaki@redhat.com> https://github.com/golang/go/commit/e243d242d7 [go] Used GitHub name "Roberto Clapis" for Roberto <empijei@users.noreply.github.com> https://github.com/golang/go/commit/963776e689 [go] Used GitHub name "Robin Eklind" for mewmew <rnd0x00@gmail.com> https://github.com/golang/go/commit/b8620afb8d [blog go proposal.git] Updates #12042 Change-Id: I1b21a18138849c537048558dd4324a823ba12a14 Reviewed-on: https://go-review.googlesource.com/c/go/+/192099 Reviewed-by: Andrew Bonventre <andybons@golang.org> Run-TryBot: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> (cherry picked from commit d0eaec79f95c2ad04d58e42c8e7cb123200cdfd5) Reviewed-on: https://go-review.googlesource.com/c/go/+/192178 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-08-27[release-branch.go1.13] cmd/go/internal/modload: fix swapped paths in error ↵Bryan C. Mills
message Cherry-picked from CL 191997. Updates #33879 Fixes #33885 Change-Id: Ifc91490b1cb791fdf5ffe69ef81c0ec0e6cbecc3 Reviewed-on: https://go-review.googlesource.com/c/go/+/191997 Run-TryBot: Bryan C. Mills <bcmills@google.com> Reviewed-by: Alexander Rakoczy <alex@golang.org> (cherry picked from commit 8f5353fd1c0598bf5c92d67ffe8cfa1424115694) Reviewed-on: https://go-review.googlesource.com/c/go/+/191972 TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-08-27[release-branch.go1.13] cmd/go/internal/get: remove '--' separator from 'git ↵Bryan C. Mills
ls-remote' command 'git ls-remote' started recognizing the '--' separator at some point after 2.7.4, but git defaults to version 2.7.4 on Ubuntu 16.04 LTS, which remains supported by Ubuntu until April 2021. We added '--' tokens to most VCS commands as a defensive measure in CL 181237, but it isn't strictly necessary here because the 'scheme' argument to our template is chosen from a predefined list: we can safely drop it to retain compatibility. Cherry-picked from CL 191978. Updates #33836 Fixes #33880 Change-Id: Ibb53366b95f8029b587e0b7646a439330d759ac7 Reviewed-on: https://go-review.googlesource.com/c/go/+/191973 Run-TryBot: Bryan C. Mills <bcmills@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-08-27[release-branch.go1.13] crypto/tls: make SSLv3 again disabled by defaultFilippo Valsorda
It was mistakenly re-enabled in CL 146217. Updates #33837 Change-Id: I8c0e1787114c6232df5888e51e355906622295bc Reviewed-on: https://go-review.googlesource.com/c/go/+/191877 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> (cherry picked from commit 2ebc3d8157fedba633ce90c5454827512734a793) Reviewed-on: https://go-review.googlesource.com/c/go/+/191998
2019-08-27[release-branch.go1.13] net/http: fix wantConnQueue memory leaks in TransportBryan C. Mills
I'm trying to keep the code changes minimal for backporting to Go 1.13, so it is still possible for a handful of entries to leak, but the leaks are now O(1) instead of O(N) in the steady state. Longer-term, I think it would be a good idea to coalesce idleMu with connsPerHostMu and clear entries out of both queues as soon as their goroutines are done waiting. Cherry-picked from CL 191964. Updates #33849 Updates #33850 Fixes #33878 Change-Id: Ia66bc64671eb1014369f2d3a01debfc023b44281 Reviewed-on: https://go-review.googlesource.com/c/go/+/191964 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> (cherry picked from commit 94bf9a8d4ad479e5a9dd57b3cb8e682e841d58d4) Reviewed-on: https://go-review.googlesource.com/c/go/+/191967
2019-08-26[release-branch.go1.13] cmd/vendor: update vendored x/arch repo to 8a70ba74b3a1Cherry Zhang
Update vendored x/arch repo to pick up the fix of issue #33802. This is done with the following commands: $ cd $GOROOT/src/cmd $ go get -d golang.org/x/arch@latest go: finding golang.org/x/arch latest go: downloading golang.org/x/arch v0.0.0-20190815191158-8a70ba74b3a1 go: extracting golang.org/x/arch v0.0.0-20190815191158-8a70ba74b3a1 $ go mod tidy $ go mod vendor Updates #33802. Fixes #33811. Change-Id: I0a44f1d83d6f573124cea1f099378b1c851f3feb Reviewed-on: https://go-review.googlesource.com/c/go/+/191619 Run-TryBot: Cherry Zhang <cherryyz@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com> (cherry picked from commit 66ff373911a87140319a6550e4e1b2c6043b1329) Reviewed-on: https://go-review.googlesource.com/c/go/+/191737 Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Andrew Bonventre <andybons@golang.org> Reviewed-by: Cherry Zhang <cherryyz@google.com>
2019-08-26[release-branch.go1.13] doc: align documents linkobei
Updates #33738 Change-Id: If0856d7c57ecfde08341c1aecb5e92361fd64f2b Reviewed-on: https://go-review.googlesource.com/c/go/+/191217 Reviewed-by: Andrew Bonventre <andybons@golang.org> Run-TryBot: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> (cherry picked from commit cded9f43f8d504159d9b71ddca7fe8abd8ba78b0) Reviewed-on: https://go-review.googlesource.com/c/go/+/191747 Reviewed-by: Katie Hockman <katie@golang.org>
2019-08-26[release-branch.go1.13] doc/go1.13: add information about using private ↵Katie Hockman
modules to the introduction Updates #33796 Fixes #33846 Change-Id: I9f6837be96410e96d004523c48bef95ee1427484 Reviewed-on: https://go-review.googlesource.com/c/go/+/191746 Reviewed-by: Bryan C. Mills <bcmills@google.com> (cherry picked from commit 989409f5279df7394faa1c3f66ef00a418f6c888) Reviewed-on: https://go-review.googlesource.com/c/go/+/191749 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2019-08-25[release-branch.go1.13] doc/go1.13: add missing slashesToshihiro Shiino
This saves a redirect and makes the document more consistent. Change-Id: Ib7f68b1967275c0c676a044314919449680297f3 Reviewed-on: https://go-review.googlesource.com/c/go/+/191537 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> (cherry picked from commit 89fb80f7fae1359a57968fbe600fc69b7296dd2d) Reviewed-on: https://go-review.googlesource.com/c/go/+/191740 Reviewed-by: Toshihiro Shiino <shiino.toshihiro@gmail.com> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2019-08-25[release-branch.go1.13] doc/go1.13: fix bad URLs to strconv identifiersEmmanuel T Odeke
Change-Id: I7db3ad060773c9396fbe34e7bd52e7ccf6e5e52c Reviewed-on: https://go-review.googlesource.com/c/go/+/191797 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> (cherry picked from commit 1a7c15fa6d5ce2d78d0f9f5050ee9dd1e29485df) Reviewed-on: https://go-review.googlesource.com/c/go/+/191739 Reviewed-by: Toshihiro Shiino <shiino.toshihiro@gmail.com> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2019-08-25[release-branch.go1.13] doc/go1.13: document fmt's number syntax updatesEmmanuel T Odeke
Fixes #32815 Change-Id: Ia8ac9943a920a056ba7dbc69c1c70fa188f7aca8 Reviewed-on: https://go-review.googlesource.com/c/go/+/191578 Reviewed-by: Robert Griesemer <gri@golang.org> (cherry picked from commit 9e1c864afe00b3cfba3e09d7c67fc17526db464a) Reviewed-on: https://go-review.googlesource.com/c/go/+/191738 Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Run-TryBot: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-08-23[release-branch.go1.13] doc/go1.13: document _ between digits for math/big, ↵Emmanuel T Odeke
strconv Document that: * math/big.Float.Parse * math/big.Int.SetString * strconv.ParseFloat * strconv.ParseInt * strconv.ParseUint now accept underscores to group digits only if base = 0, as per the Go 2 language changes. Updates #32815 Change-Id: Id45bd803a18442436419739297e8aed0d32ca56c Reviewed-on: https://go-review.googlesource.com/c/go/+/191077 Reviewed-by: Robert Griesemer <gri@golang.org> (cherry picked from commit e764432605cb26478067890b49f4f16019c9a9b9) Reviewed-on: https://go-review.googlesource.com/c/go/+/191477 Run-TryBot: Andrew Bonventre <andybons@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-08-23[release-branch.go1.13] net/http: update bundled golang.org/x/net/http2 to ↵Filippo Valsorda
import security fix Update golang.org/x/net to v0.0.0-20190813141303-74dc4d7220e7 to import the following security fix. commit 74dc4d7220e7acc4e100824340f3e66577424772 Author: Filippo Valsorda <filippo@golang.org> Date: Sun Aug 11 02:12:18 2019 -0400 http2: limit number of control frames in server send queue An attacker could cause servers to queue an unlimited number of PING ACKs or RST_STREAM frames by soliciting them and not reading them, until the program runs out of memory. Limit control frames in the queue to a few thousands (matching the limit imposed by other vendors) by counting as they enter and exit the scheduler, so the protection will work with any WriteScheduler. Once the limit is exceeded, close the connection, as we have no way to communicate with the peer. Change-Id: I842968fc6ed3eac654b497ade8cea86f7267886b Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/525552 Reviewed-by: Brad Fitzpatrick <bradfitz@google.com> This change was generated with cmd/go and cmd/bundle: $ go get -u golang.org/x/net $ go mod tidy $ go mod vendor $ go generate net/http Fixes CVE-2019-9512 and CVE-2019-9514 Fixes #33606 Change-Id: I464baf96175006aa101d65d3b0f6494f28a626ab Reviewed-on: https://go-review.googlesource.com/c/go/+/190137 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> (cherry picked from commit 145e193131eb486077b66009beb051aba07c52a5) Reviewed-on: https://go-review.googlesource.com/c/go/+/191618 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-08-22[release-branch.go1.13] net/http: change TimeoutHandler's docs to match its ↵Jeff Hodges
new interfaces As of Go 1.13rc1, TimeoutHandler supports the Flusher and Pusher interfaces and this change corrects its documentation to say that. Fixes #33769 Updates #29193 Change-Id: Ia0523f7f2e3dc1f8f0b68950b85a7bf81c4abe60 GitHub-Last-Rev: 5310d2c9608a1af2d3030a9573e920906c76744e GitHub-Pull-Request: golang/go#33770 Reviewed-on: https://go-review.googlesource.com/c/go/+/191237 Reviewed-by: Andrew Bonventre <andybons@golang.org> Run-TryBot: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> (cherry picked from commit f3e3b71a50d7a247d07cc4e4295ec2dc44b04b6a) Reviewed-on: https://go-review.googlesource.com/c/go/+/191169 Reviewed-by: Bryan C. Mills <bcmills@google.com>
2019-08-22[release-branch.go1.13] strconv: update documentationEmmanuel T Odeke
Fixes #33750. Updates #31197. Change-Id: I26f63cef57e5f0eec85b84554c82f6d47b4f41a1 Reviewed-on: https://go-review.googlesource.com/c/go/+/191078 Reviewed-by: Robert Griesemer <gri@golang.org> (cherry picked from commit d9b13233378668a4fd24ac5d044e9d550cd2a8be) Reviewed-on: https://go-review.googlesource.com/c/go/+/191168 Run-TryBot: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2019-08-21[release-branch.go1.13] go1.13rc1go1.13rc1Andrew Bonventre
Change-Id: I2921895d336c8f63e521b5c921494917b4f42f79 Reviewed-on: https://go-review.googlesource.com/c/go/+/191157 Run-TryBot: Andrew Bonventre <andybons@golang.org> Reviewed-by: Katie Hockman <katie@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-08-21Revert "encoding/json: avoid work when unquoting strings"Filippo Valsorda
This reverts CL 151157. CL 151157 introduced a crash when decoding into ",string" fields. It came with a moderate speedup, so at this stage of the release cycle let's just revert it, and reapply it in Go 1.14 with the fix in CL 190659. Also applied the test cases from CL 190659. Updates #33728 Change-Id: Ie46e2bc15224b251888580daf6b79d5865f3878e Reviewed-on: https://go-review.googlesource.com/c/go/+/190909 Run-TryBot: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Andrew Bonventre <andybons@golang.org>
2019-08-21cmd/go: accept GOSUMDB=sum.golang.google.cnRuss Cox
This CL makes the go command understand that GOSUMDB=sum.golang.google.cn should connect to that domain but expect to find a checksum database signed by sum.golang.org there. The host sum.golang.google.cn is not yet completely configured; we hope it will be available in a few weeks. Change-Id: Ie0fc4323f0c7084dda59bd3b45fc406717fa16d9 Reviewed-on: https://go-review.googlesource.com/c/go/+/191137 Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Andrew Bonventre <andybons@golang.org>
2019-08-20doc/go1.13: mention '-o <directory>' support for 'go build'Bryan C. Mills
Fixes #33720 Updates #14295 Change-Id: I9cb6e02bcaccd7971057315163d8810157d465bd Reviewed-on: https://go-review.googlesource.com/c/go/+/190907 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com>
2019-08-20cmd/go: fix "go help build -o" docsFilippo Valsorda
The docs refer to "the last two paragraphs", but in fact should refer to the first two of the previous three paragraphs. Moved up the out of place paragraph. Updates #14295 Change-Id: I066da7a665bc6754d246782b941af214a385017a Reviewed-on: https://go-review.googlesource.com/c/go/+/190839 Reviewed-by: Bryan C. Mills <bcmills@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-08-19doc: rewrite reference to plan9.bell-labs.com to 9p.ioWagner Riffel
Change-Id: I75619feced842b8ca509ee08e01b63258c5e87ca Reviewed-on: https://go-review.googlesource.com/c/go/+/190757 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-08-18encoding/json: fix format string in the Fuzz funcDmitry Vyukov
Currently test build fails with: $ go test -tags=gofuzz encoding/json encoding/json/fuzz.go:36:4: Println call has possible formatting directive %s FAIL encoding/json [build failed] Change-Id: I23aef44a421ed0e7bcf48b74ac5a8c6768a4841b Reviewed-on: https://go-review.googlesource.com/c/go/+/190698 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2019-08-16time: update TestSub to avoid future regressionsJoe Tsai
CL 131196 optimized Time.Sub, but was reverted because it incorrectly computed the nanoseconds in some edge cases. This CL adds a test case to enforce the correct behavior so that a future optimization does not break this again. Updates #17858 Updates #33677 Change-Id: I596d8302ca6bf721cf7ca11cc6f939639fcbdd43 Reviewed-on: https://go-review.googlesource.com/c/go/+/190524 Run-TryBot: Joe Tsai <thebrokentoaster@gmail.com> Reviewed-by: Daniel Martí <mvdan@mvdan.cc> Reviewed-by: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-08-16cmd/gofmt: update TestRewrite to avoid future regressionsJoe Tsai
CL 162337 changed go/ast to better handle block comments, but was reverted because it introduced an off-by-one bug. This CL adds a test case to enforce the correct behavior so that future changes do not break this again. Updates #18929 Updates #33538 Change-Id: I2d25c139d007f8db1091b7a48b1dd20c584e2699 Reviewed-on: https://go-review.googlesource.com/c/go/+/190523 Run-TryBot: Joe Tsai <thebrokentoaster@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Robert Griesemer <gri@golang.org>
2019-08-16Revert "time: optimize Sub"Joe Tsai
This reverts commit CL 131196 because there is a bug in the calculation of nanoseconds. Fixes #33677 Change-Id: Ic8e94c547ee29b8aeda1b9a5cb9764dbf47b14b4 Reviewed-on: https://go-review.googlesource.com/c/go/+/190497 Run-TryBot: Andrew Bonventre <andybons@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Reviewed-by: Andrew Bonventre <andybons@golang.org>
2019-08-15doc: document Go 1.12.9Dmitri Shuralyov
Change-Id: I88b7e085fc70f9c021788d364099f5bc6b705ba8 Reviewed-on: https://go-review.googlesource.com/c/go/+/190438 Reviewed-by: Filippo Valsorda <filippo@golang.org>
2019-08-15doc: document Go 1.12.8 and Go 1.11.13Dmitri Shuralyov
Change-Id: I0daab6cd347e1fc0066e516f02c33f1b63e3f1a3 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/526992 Reviewed-by: Filippo Valsorda <valsorda@google.com> (cherry picked from commit 305f6dc30cfd163aa959ec4bd2a912f7c29da5c8) Reviewed-on: https://go-review.googlesource.com/c/go/+/190437 Reviewed-by: Filippo Valsorda <filippo@golang.org>
2019-08-14reflect: align first argument in callMethodCherry Zhang
When calling a function obtained from reflect.Value.Method (or MethodByName), we copy the arguments from the caller frame, which does not include the receiver, to a new frame to call the actual method, which does include the receiver. Here we need to align the first (non-receiver) argument. As the receiver is pointer sized, it is generally naturally aligned, except on amd64p32, where the argument can have larger alignment, and this aligning becomes necessary. Fixes #33628. Change-Id: I5bea0e20173f06d1602c5666d4f334e3d0de5c1e Reviewed-on: https://go-review.googlesource.com/c/go/+/190297 Run-TryBot: Cherry Zhang <cherryyz@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Keith Randall <khr@golang.org>
2019-08-14doc/go1.13: add missing periodsToshihiro Shiino
Change-Id: If9ad650174572c475f0b3d3394208c2a9dd0a596 Reviewed-on: https://go-review.googlesource.com/c/go/+/190237 Reviewed-by: Agniva De Sarker <agniva.quicksilver@gmail.com>
2019-08-12net/url: make Hostname and Port predictable for invalid Host valuesFilippo Valsorda
When Host is not valid per RFC 3986, the behavior of Hostname and Port was wildly unpredictable, to the point that Host could have a suffix that didn't appear in neither Hostname nor Port. This is a security issue when applications are applying checks to Host and expecting them to be meaningful for the contents of Hostname. To reduce disruption, this change only aims to guarantee the following two security-relevant invariants. * Host is either Hostname or [Hostname] with Port empty, or Hostname:Port or [Hostname]:Port. * Port is only decimals. The second invariant is the one that's most likely to cause disruption, but I believe it's important, as it's conceivable an application might do a suffix check on Host and expect it to be meaningful for the contents of Hostname (if the suffix is not a valid port). There are three ways to ensure it. 1) Reject invalid ports in Parse. Note that non-numeric ports are already rejected if and only if the host starts with "[". 2) Consider non-numeric ports as part of Hostname, not Port. 3) Allow non-numeric ports, and hope they only flow down to net/http, which will reject them (#14353). This change adopts both 1 and 2. We could do only the latter, but then these invalid hosts would flow past port checks, like in http_test.TestTransportRejectsAlphaPort. Non-numeric ports weren't fully supported anyway, because they were rejected after IPv6 literals, so this restores consistency. We could do only the former, but at this point 2) is free and might help with manually constructed Host values (or if we get something wrong in Parse). Note that net.SplitHostPort and net.Dial explicitly accept service names in place of port numbers, but this is an URL package, and RFC 3986, Section 3.2.3, clearly specifies ports as a number in decimal. net/http uses a mix of net.SplitHostPort and url.Parse that would deserve looking into, but in general it seems that it will still accept service names in Addr fields as they are passed to net.Listen, while rejecting them in URLs, which feels correct. This leaves a number of invalid URLs to reject, which however are not security relevant once the two invariants above hold, so can be done in Go 1.14: IPv6 literals without brackets (#31024), invalid IPv6 literals, hostnames with invalid characters, and more. Tested with 200M executions of go-fuzz and the following Fuzz function. u, err := url.Parse(string(data)) if err != nil { return 0 } h := u.Hostname() p := u.Port() switch u.Host { case h + ":" + p: return 1 case "[" + h + "]:" + p: return 1 case h: fallthrough case "[" + h + "]": if p != "" { panic("unexpected Port()") } return 1 } panic("Host is not a variant of [Hostname]:Port") Fixes CVE-2019-14809 Updates #29098 Change-Id: I7ef40823dab28f29511329fa2d5a7fb10c3ec895 Reviewed-on: https://go-review.googlesource.com/c/go/+/189258 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2019-08-12src/go.mod: sync golang.org/x/net with h2_bundle.goFilippo Valsorda
The bundle included changes from a commit after the one referred to by the go.mod, probably due to cmd/bundle using the GOPATH source. Identified with the new go/packages based cmd/bundle from CL 189818. $ go get golang.org/x/net@461777fb6f $ go mod tidy $ go mod vendor $ go generate net/http # with CL 189818 Also, updated the socks_bundle.go generate command to drop obsolete options and match h2_bundle.go. It caused no output changes. Updates #32031 Change-Id: I0322d4e842dbfdad749455111072ca4872a62ad4 Reviewed-on: https://go-review.googlesource.com/c/go/+/189897 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2019-08-11net: document that a keep-alive failure also returns a timeoutIan Lance Taylor
Updates #31449 Change-Id: I76490c5e83eb2f7ba529b387a57ba088428aece5 Reviewed-on: https://go-review.googlesource.com/c/go/+/189757 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2019-08-11doc/asm: document go_asm.h only works in the runtime packagePure White
Fixes #33054 Change-Id: I687d45e092d721a6c22888cc7ddbe420c16a5af9 GitHub-Last-Rev: a7208c89a0d613a53ab057e0b4418ae4719cfcbd GitHub-Pull-Request: golang/go#33069 Reviewed-on: https://go-review.googlesource.com/c/go/+/185917 Reviewed-by: Rob Pike <r@golang.org>
2019-08-10doc/go1.13: mention faster sync.Mutex/RWMutex/OnceCarlo Alberto Ferraris
Mention faster sync.Mutex/RWMutex/Once in the 1.13 release notes. Change-Id: I29d8a5004a0af42542e8db82a8c9e2e06a15dbb0 GitHub-Last-Rev: 2995401dab563ea5af98c0f5351f51a6116f105e GitHub-Pull-Request: golang/go#33404 Reviewed-on: https://go-review.googlesource.com/c/go/+/188479 Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2019-08-09doc/install-source: create distinction between steps that involve "git clone"K. "pestophagous" Heller
Prior doc implied that "git clone" was one way to obtain a go1.4 bootstrap toochain, but it did not state this outright. Further, the doc did not make it explicit in the "Fetch the repository" section that one must necessarily "git clone" a second time in the (presumed-to-be-uncommon) case where "git clone" had already been perfomed in the "compiler binaries" section. Updates #33402 Change-Id: Id70a6587b6ee09aca13559d63868b75cb07dff1e Reviewed-on: https://go-review.googlesource.com/c/go/+/188900 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2019-08-09cmd/link: increase the function call limit in stkcheckIan Lance Taylor
There is real (albeit generated) code that exceeds the limit. Fixes #33555 Change-Id: I668e85825d3d2a471970e869abe63f3492213cc1 Reviewed-on: https://go-review.googlesource.com/c/go/+/189697 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Cherry Zhang <cherryyz@google.com>
2019-08-09doc/install-source.html: add new GOOS and GOARCHesAgniva De Sarker
And also insert new paragraphs between GOOS and GOARCH listings for better readability. Fixes #28142 Fixes #26513 Change-Id: Ie92e98dbfd924e80032a12afbfa02f30e3a6f916 Reviewed-on: https://go-review.googlesource.com/c/go/+/189578 Reviewed-by: Andrew Bonventre <andybons@golang.org>
2019-08-09cmd/go: query each path only once in 'go get'Bryan C. Mills
If we don't know whether a path is a module path or a package path, previously we would first try a module query for it, then fall back to a package query. If we are using a sequence of proxies with fallback (as will be the default in Go 1.13), and the path is not actually a module path, that initial module query will fail against the first proxy, then immediately fall back to the next proxy in the sequence — even if the query could have been satisfied by some other (prefix) module available from the first proxy. Instead, we now query the requested path as only one kind of path. If we query it as a package path but it turns out to only exist as a module, we can detect that as a PackageNotInModuleError with an appropriate module path — we do not need to issue a second query to classify it. Fixes #31785 Change-Id: I581d44279196e41d1fed27ec25489e75d62654e3 Reviewed-on: https://go-review.googlesource.com/c/go/+/189517 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com>
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion