aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-09-01[release-branch.go1.15-security] go1.15.1go1.15.1Dmitri Shuralyov
Change-Id: I4103c524ce46d50215af5097460e514609b513c6 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/835373 Reviewed-by: Filippo Valsorda <valsorda@google.com>
2020-09-01[release-branch.go1.15-security] net/http/cgi,net/http/fcgi: add ↵Roberto Clapis
Content-Type detection This CL ensures that responses served via CGI and FastCGI have a Content-Type header based on the content of the response if not explicitly set by handlers. If the implementers of the handler did not explicitly specify a Content-Type both CGI implementations would default to "text/html", potentially causing cross-site scripting. Thanks to RedTeam Pentesting GmbH for reporting this. Fixes CVE-2020-24553 Change-Id: I82cfc396309b5ab2e8d6e9a87eda8ea7e3799473 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/823217 Reviewed-by: Russ Cox <rsc@google.com> (cherry picked from commit 23d675d07fdc56aafd67c0a0b63d5b7e14708ff0) Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/835311 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2020-08-11[release-branch.go1.15] go1.15go1.15Andrew Bonventre
Change-Id: Id2262ff66e750e798ebe7ecfcc13d2653cb85b71 Reviewed-on: https://go-review.googlesource.com/c/go/+/247905 Run-TryBot: Andrew Bonventre <andybons@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-08-11[release-branch.go1.15] all: merge master into release-branch.go1.15Andrew
5c7748dc9d doc/go1.15: encoding/json's CL 191783 was reverted 5ff5b3c557 doc/go1.15: remove draft notice 5ae1d62ee3 CONTRIBUTORS: update for the Go 1.15 release 7ad776dda5 doc/go1.15: document crypto/tls permanent error a93a4c1780 runtime: make nanotime1 reentrant Updates #40697 Change-Id: Ie39896ee6304544cc9e9c1938bdf176f1dcf8766 Reviewed-on: https://go-review.googlesource.com/c/go/+/247900 Run-TryBot: Andrew Bonventre <andybons@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Carlos Amedee <carlos@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-08-07[release-branch.go1.15] go1.15rc2go1.15rc2Alexander Rakoczy
Change-Id: I2fe55c3f0328291b7d602cfae83d3f0b72cee14c Reviewed-on: https://go-review.googlesource.com/c/go/+/247238 Run-TryBot: Alexander Rakoczy <alex@golang.org> Reviewed-by: Carlos Amedee <carlos@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-08-06[release-branch.go1.15] all: merge master into release-branch.go1.15Alexander Rakoczy
ba9e108899 cmd: update golang.org/x/xerrors 027d7241ce encoding/binary: read at most MaxVarintLen64 bytes in ReadUvarint 6f08e89ec3 cmd/go: fix error stacks when there are scanner errors f235275097 net/http: fix cancelation of requests with a readTrackingBody wrapper f92337422e runtime/race: fix ppc64le build e49b2308a5 runtime/race: rebuild some .syso files to remove getauxval dependency 10523c0efb doc/go1.15: fix a few trivial inconsistencies 7388956b76 cmd/cgo: fix mangling of enum and union types b56791cdea runtime: validate candidate searchAddr in pageAlloc.find 10374e2435 testing: fix quotation marks 7f86080476 cmd/compile: don't addLocalInductiveFacts if there is no direct edge from if block to phi block 54e75e8f9d crypto/ed25519: remove s390x KDSA implementation 6b4dcf19fa runtime: hold sched.lock over globrunqputbatch in runqputbatch 85afa2eb19 runtime: ensure startm new M is consistently visible to checkdead c4fed25553 cmd/compile: add floating point load+op operations to addressing modes pass 19a932ceb8 cmd/link: don't mark shared library symbols reachable unconditionally 8696ae82c9 syscall: use correct file descriptor in dup2 fallback path 9591515f51 runtime, sync: add copyright headers to new files 074f2d800f doc/go1.15: surface the crypto/x509 CommonName deprecation note Change-Id: I0bfcff1fc2de723960909d9dda718fee6abc2912
2020-08-06cmd: update golang.org/x/xerrorsAlexander Rakoczy
This pulls in CL 247217. Fixes #40573 Change-Id: I89eeebb5da9a4668adc6b5c5155651e5da421d59 Reviewed-on: https://go-review.googlesource.com/c/go/+/247186 Run-TryBot: Alexander Rakoczy <alex@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-08-06encoding/binary: read at most MaxVarintLen64 bytes in ReadUvarintKatie Hockman
This CL ensures that ReadUvarint consumes only a limited amount of input (instead of an unbounded amount). On some inputs, ReadUvarint could read an arbitrary number of bytes before deciding to return an overflow error. After this CL, ReadUvarint returns that same overflow error sooner, after reading at most MaxVarintLen64 bytes. Fix authored by Robert Griesemer and Filippo Valsorda. Thanks to Diederik Loerakker, Jonny Rhea, Raúl Kripalani, and Preston Van Loon for reporting this. Fixes #40618 Fixes CVE-2020-16845 Change-Id: Ie0cb15972f14c38b7cf7af84c45c4ce54909bb8f Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/812099 Reviewed-by: Filippo Valsorda <valsorda@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/247120 Run-TryBot: Katie Hockman <katie@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Alexander Rakoczy <alex@golang.org>
2020-08-05cmd/go: fix error stacks when there are scanner errorsMichael Matloob
After golang.org/cl/228784 setLoadPackageDataError tries to decide whether an error is caused by an imported package or an importing package by examining the error itself to decide. Ideally, the errors themselves would belong to a specific interface or some other property to make it unambiguous that they were import errors. Since they don't, setLoadPackageDataError just checked for nogoerrors and classified all other errors as import errors. But it missed scanner errors which are also "caused" by the imported package. Fixes #40544 Change-Id: I39159bfdc286bee73697decd07b8aa9451f2db06 Reviewed-on: https://go-review.googlesource.com/c/go/+/246717 Run-TryBot: Michael Matloob <matloob@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com>
2020-08-04net/http: fix cancelation of requests with a readTrackingBody wrapperDamien Neil
Use the original *Request in the reqCanceler map, not the transient wrapper created to handle body rewinding. Change the key of reqCanceler to a struct{*Request}, to make it more difficult to accidentally use the wrong request as the key. Fixes #40453. Change-Id: I4e61ee9ff2c794fb4c920a3a66c9a0458693d757 Reviewed-on: https://go-review.googlesource.com/c/go/+/245357 Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2020-08-02runtime/race: fix ppc64le buildKeith Randall
The .syso test also fails for ppc64le. Not sure why. For now, just disable the test for that architecture. The test really only needs to run on a single builder of any arch. Change-Id: I346cdc01ada09d43c4c504fbc30be806f59d5422 Reviewed-on: https://go-review.googlesource.com/c/go/+/246358 Run-TryBot: Keith Randall <khr@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-08-01runtime/race: rebuild some .syso files to remove getauxval dependencyKeith Randall
We can't depend on getauxval because it only exists in glibc >= 2.16. Tsan has been updated to avoid that dependency (https://reviews.llvm.org/D84859). This CL rebuilds the affected .syso files, and adds a test to make sure we don't regress. Fixes #37485 Change-Id: I891f54d28ec0d7da50a8df1adadc76dd6e7ab3e0 Reviewed-on: https://go-review.googlesource.com/c/go/+/246258 Run-TryBot: Keith Randall <khr@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
2020-08-01doc/go1.15: fix a few trivial inconsistenciesToshihiro Shiino
For #37419 Change-Id: I8ede539df5d5344aeb44ba1a7e2383363d92157f Reviewed-on: https://go-review.googlesource.com/c/go/+/245977 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-07-31cmd/cgo: fix mangling of enum and union typesMatthew Dempsky
Consider this test package: package p // enum E { E0 }; // union U { long x; }; // void f(enum E e, union U* up) {} import "C" func f() { C.f(C.enum_E(C.E0), (*C.union_U)(nil)) } In Go 1.14, cgo translated this to (omitting irrelevant details): type _Ctype_union_U [8]byte func f() { _Cfunc_f(uint32(_Ciconst_E0), (*[8]byte)(nil)) } func _Cfunc_f(p0 uint32, p1 *[8]byte) (r1 _Ctype_void) { ... } Notably, _Ctype_union_U was declared as a defined type, but uses were being rewritten into uses of the underlying type, which matched how _Cfunc_f was declared. After CL 230037, cgo started consistently rewriting "C.foo" type expressions as "_Ctype_foo", which caused it to start emitting: type _Ctype_enum_E uint32 type _Ctype_union_U [8]byte func f() { _Cfunc_f(_Ctype_enum_E(_Ciconst_E0), (*_Ctype_union_U)(nil)) } // _Cfunc_f unchanged Of course, this fails to type-check because _Ctype_enum_E and _Ctype_union_U are defined types. This CL changes cgo to emit: type _Ctype_enum_E = uint32 type _Ctype_union_U = [8]byte // f unchanged since CL 230037 // _Cfunc_f still unchanged It would probably be better to fix this in (*typeConv).loadType so that cgo generated code uses the _Ctype_foo aliases too. But as it wouldn't have any effect on actual compilation, it's not worth the risk of touching it at this point in the release cycle. Updates #39537. Fixes #40494. Change-Id: I88269660b40aeda80a9a9433777601a781b48ac0 Reviewed-on: https://go-review.googlesource.com/c/go/+/246057 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-07-31runtime: validate candidate searchAddr in pageAlloc.findMichael Anthony Knyszek
Currently pageAlloc.find attempts to find a better estimate for the first free page in the heap, even if the space its looking for isn't necessarily going to be the first free page in the heap (e.g. if npages >= 2). However, in doing so it has the potential to return a searchAddr candidate that doesn't actually correspond to mapped memory, but this candidate might still be adopted. As a result, pageAlloc.alloc's fast path may look at unmapped summary memory and segfault. This case is rare on most operating systems since the heap is kept fairly contiguous, so the chance that the candidate searchAddr discovered is unmapped is fairly low. Even so, this is totally possible and outside the user's control when it happens (in fact, it's likely to happen consistently for a given user on a given system). Fix this problem by ensuring that our candidate always points to mapped memory. We do this by looking at mheap's arenas structure first. If it turns out our candidate doesn't correspond to mapped memory, then we look at inUse to round up the searchAddr to the next mapped address. While we're here, clean up some documentation related to searchAddr. Fixes #40191. Change-Id: I759efec78987e4a8fde466ae45aabbaa3d9d4214 Reviewed-on: https://go-review.googlesource.com/c/go/+/242680 Run-TryBot: Michael Knyszek <mknyszek@google.com> Reviewed-by: Austin Clements <austin@google.com> Reviewed-by: Michael Pratt <mpratt@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-07-30testing: fix quotation marksKatie Hockman
Change-Id: I4b816e26718ef5521afba2b200a6333373b09c58 Reviewed-on: https://go-review.googlesource.com/c/go/+/245136 Run-TryBot: Katie Hockman <katie@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-07-30cmd/compile: don't addLocalInductiveFacts if there is no direct edge from if ↵Cholerae Hu
block to phi block Currently in addLocalInductiveFacts, we only check whether direct edge from if block to phi block exists. If not, the following logic will treat the phi block as the first successor, which is wrong. This patch makes prove pass more conservative, so we disable some cases in test/prove.go. We will do some optimization in the following CL and enable these cases then. Fixes #40367. Change-Id: I27cf0248f3a82312a6f7dabe11c79a1a34cf5412 Reviewed-on: https://go-review.googlesource.com/c/go/+/244579 Reviewed-by: Zach Jones <zachj1@gmail.com> Reviewed-by: Keith Randall <khr@golang.org> Run-TryBot: Keith Randall <khr@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-07-30crypto/ed25519: remove s390x KDSA implementationMichael Munday
This reverts CL 202578 and CL 230677 which added an optimization to use KDSA when available on s390x. Inconsistencies have been found between the two implementations in their handling of certain edge cases. Since the Go 1.15 release is extremely soon it seems prudent to remove this optimization for now and revisit it in a future release. Fixes #40475. Change-Id: Ifb2ed9b9e573784df57383671f1c29d8abae90d4 Reviewed-on: https://go-review.googlesource.com/c/go/+/245497 Run-TryBot: Michael Munday <mike.munday@ibm.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ruixin(Peter) Bao <ruixin.bao@ibm.com> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2020-07-30runtime: hold sched.lock over globrunqputbatch in runqputbatchMichael Anthony Knyszek
globrunqputbatch should never be called without sched.lock held. runqputbatch's documentation even says it may acquire sched.lock in order to call it. Fixes #40457. Change-Id: I5421b64f1da3a6087dfebbef7203db0c95d213a8 Reviewed-on: https://go-review.googlesource.com/c/go/+/245377 Run-TryBot: Michael Knyszek <mknyszek@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Cherry Zhang <cherryyz@google.com> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-07-28runtime: ensure startm new M is consistently visible to checkdeadMichael Pratt
If no M is available, startm first grabs an idle P, then drops sched.lock and calls newm to start a new M to run than P. Unfortunately, that leaves a window in which a G (e.g., returning from a syscall) may find no idle P, add to the global runq, and then in stopm discover that there are no running M's, a condition that should be impossible with runnable G's. To avoid this condition, we pre-allocate the new M ID in startm before dropping sched.lock. This ensures that checkdead will see the M as running, and since that new M must eventually run the scheduler, it will handle any pending work as necessary. Outside of startm, most other calls to newm/allocm don't have a P at all. The only exception is startTheWorldWithSema, which always has an M if there is 1 P (i.e., the currently running M), and if there is >1 P the findrunnable spinning dance ensures the problem never occurs. This has been tested with strategically placed sleeps in the runtime to help induce the correct race ordering, but the timing on this is too narrow for a test that can be checked in. Fixes #40368 Change-Id: If5e0293a430cc85154b7ed55bc6dadf9b340abe2 Reviewed-on: https://go-review.googlesource.com/c/go/+/245018 Run-TryBot: Michael Pratt <mpratt@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Austin Clements <austin@google.com>
2020-07-27cmd/compile: add floating point load+op operations to addressing modes passKeith Randall
They were missed as part of the refactoring to use a separate addressing modes pass. Fixes #40426 Change-Id: Ie0418b2fac4ba1ffe720644ac918f6d728d5e420 Reviewed-on: https://go-review.googlesource.com/c/go/+/244859 Run-TryBot: Keith Randall <khr@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Cherry Zhang <cherryyz@google.com>
2020-07-27cmd/link: don't mark shared library symbols reachable unconditionallyCherry Zhang
During the transitioning period, we mark symbols from Go shared libraries reachable unconditionally. That might be useful when there was still a large portion of the linker using sym.Symbols, and only reachable symbols were converted to sym.Symbols. Marking them reachable brings them to the dynamic symbol table, even if they are not needed, increased the binary size unexpectedly. That time has passed. Now we largely operate on loader symbols, and it is not needed to mark them reachable anymore. Fixes #40416. Change-Id: I1e2bdb93a960ba7dc96575fabe15af93d8e95329 Reviewed-on: https://go-review.googlesource.com/c/go/+/244839 Run-TryBot: Cherry Zhang <cherryyz@google.com> Reviewed-by: Austin Clements <austin@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-07-25syscall: use correct file descriptor in dup2 fallback pathIan Lance Taylor
This fixes a mistake in CL 220422. This changes code that is only executed on Linux kernel versions earlier than 2.6.27. Change-Id: I01280184f4d7b75e06387c38f1891e8f0a81f793 Reviewed-on: https://go-review.googlesource.com/c/go/+/244630 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
2020-07-25runtime, sync: add copyright headers to new filesIan Lance Taylor
For #38029 Change-Id: I71de2b66c1de617d32c46d4f2c1866f9ff1756ec Reviewed-on: https://go-review.googlesource.com/c/go/+/244631 Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Dan Scales <danscales@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-07-24doc/go1.15: surface the crypto/x509 CommonName deprecation noteFilippo Valsorda
Updates #39568 Updates #37419 Updates #24151 Change-Id: I44c940e09e26a039076396bbfecb2b1574197cf7 Reviewed-on: https://go-review.googlesource.com/c/go/+/243221 Reviewed-by: Kevin Burke <kev@inburke.com>
2020-07-24[release-branch.go1.15] go1.15rc1go1.15rc1Alexander Rakoczy
Change-Id: I660c4655dfa0914dbe09a68921e102d06d9a2ed1 Reviewed-on: https://go-review.googlesource.com/c/go/+/244761 Run-TryBot: Alexander Rakoczy <alex@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Carlos Amedee <carlos@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-07-23doc/go1.15: announce GO386=387 deprecationAustin Clements
For #40255. Updates #37419. Change-Id: If9210c855cc2eea079e7e469463d4203888748f7 Reviewed-on: https://go-review.googlesource.com/c/go/+/243137 Reviewed-by: Andrew Bonventre <andybons@golang.org>
2020-07-22runtime: don't mlock on Ubuntu 5.4 systemsIan Lance Taylor
For #35777 For #37436 Fixes #40184 Change-Id: I68561497d9258e994d1c6c48d4fb41ac6130ee3a Reviewed-on: https://go-review.googlesource.com/c/go/+/244059 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Austin Clements <austin@google.com>
2020-07-20cmd/compile: add test for fixed ICE on untyped conversionAlberto Donizetti
The ICE reported as #33308 was fixed by a related CL; this change adds a regression test with the crasher. Fixes #33308 Change-Id: I3260075dbe3823b56b8825e6269e57a0fad185a6 Reviewed-on: https://go-review.googlesource.com/c/go/+/243458 Reviewed-by: Matthew Dempsky <mdempsky@google.com>
2020-07-17doc/go1.15: add release notes for math/cmplxBrian Kessler
Updates #37419 Change-Id: Id7c9aba518c826c1a6fccbbf82210072bd3346f3 Reviewed-on: https://go-review.googlesource.com/c/go/+/242903 Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Reviewed-by: Robert Griesemer <gri@golang.org>
2020-07-17go/printer: remove exported StdFormat flagDmitri Shuralyov
The StdFormat flag was added as part of CL 231461, where the primary aim was to fix the bug #37476. It's expected that the existing printer modes only adjust spacing but do not change any of the code text itself. A new printing flag served as a way for cmd/gofmt and go/format to delegate a part of formatting work to the printer—where it's more more convenient and efficient to perform—while maintaining current low-level printing behavior of go/printer unmodified. We already have cmd/gofmt and the go/format API that implement standard formatting of Go source code, so there isn't a need to expose StdFormat flag to the world, as it can only cause confusion. Consider that to format source in canonical gofmt style completely it may require tasks A, B, C to be done. In one version of Go, the printer may do both A and B, while cmd/gofmt and go/format will do the remaining task C. In another version, the printer may take on doing just A, while cmd/gofmt and go/format will perform B and C. This makes it hard to add a gofmt-like mode to the printer without compromising on above fluidity. This change prefers to shift back some complexity to the implementation of the standard library, allowing us to avoid creating the new exported printing flag just for the internal needs of gofmt and go/format today. We may still want to re-think the API and consider if something better should be added, but unfortunately there isn't time for Go 1.15. We are not adding new APIs now, so we can defer this decision until Go 1.16 or later, when there is more time. For #37476. For #37453. For #39489. For #37419. Change-Id: I0bb07156dca852b043487099dcf05c5350b29e20 Reviewed-on: https://go-review.googlesource.com/c/go/+/240683 Reviewed-by: Robert Griesemer <gri@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2020-07-16compress/flate: fix another deflate Reset inconsistencyRuss Cox
While investigating #34121, fixed by CL 193605, I discovered another case where Reset was not quite resetting enough. This specific case is not a problem in Reset itself but rather that the Huffman bit writer in one code path is using uninitialized memory left over from a previous block, making the compression not choose the optimal compression method. Fixes #34121. Change-Id: I29245b28214d924e382f91e2c56b4b8a9b7da13d Reviewed-on: https://go-review.googlesource.com/c/go/+/243140 Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Joe Tsai <thebrokentoaster@gmail.com>
2020-07-16compress/flate: fix deflate Reset consistencyKlaus Post
Modify the overflow detection logic to shuffle the contents of the table to a lower offset to avoid leaking the effects of a previous use of compress.Writer past Reset calls. Fixes #34121 Change-Id: I9963eadfa5482881e7b7adbad4c2cae146b669ab GitHub-Last-Rev: 8b35798cdd4d5a901d6422647b12984d7e500ba3 GitHub-Pull-Request: golang/go#34128 Reviewed-on: https://go-review.googlesource.com/c/go/+/193605 Reviewed-by: Joe Tsai <thebrokentoaster@gmail.com> Run-TryBot: Joe Tsai <thebrokentoaster@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-07-15cmd/link: skip TestOldLink if the old linker does not existCherry Zhang
We don't ship the old linker in binary releases. Skip the test if we cannot find the old linker. Fixes #39509. Change-Id: I1af5552bc56aff5314a384bcb5f3717b725d68e5 Reviewed-on: https://go-review.googlesource.com/c/go/+/242604 Run-TryBot: Cherry Zhang <cherryyz@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2020-07-14net/http: synchronize "100 Continue" write and Handler writesRuss Cox
The expectContinueReader writes to the connection on the first Request.Body read. Since a Handler might be doing a read in parallel or before a write, expectContinueReader needs to synchronize with the ResponseWriter, and abort if a response already went out. The tests will land in a separate CL. Fixes #34902 Fixes CVE-2020-15586 Change-Id: Icdd8dd539f45e8863762bd378194bb4741e875fc Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/793350 Reviewed-by: Filippo Valsorda <valsorda@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/242598 Run-TryBot: Katie Hockman <katie@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-07-14crypto/x509: respect VerifyOptions.KeyUsages on WindowsFilippo Valsorda
When using the platform verifier on Windows (because Roots is nil) we were always enforcing server auth EKUs if DNSName was set, and none otherwise. If an application was setting KeyUsages, they were not being respected. Started correctly surfacing IncompatibleUsage errors from the system verifier, as those are the ones applications will see if they are affected by this change. Also refactored verify_test.go to make it easier to add tests for this, and replaced the EKULeaf chain with a new one that doesn't have a SHA-1 signature. Thanks to Niall Newman for reporting this. Fixes #39360 Fixes CVE-2020-14039 Change-Id: If5c00d615f2944f7d57007891aae1307f9571c32 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/774414 Reviewed-by: Katie Hockman <katiehockman@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/242597 Run-TryBot: Katie Hockman <katie@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-07-14html/template: add tests from text/templateRuss Cox
Copy and adapt tests from text/template, to exercise more of html/template's copy. Various differences in behavior are flagged with NOTE comments or t.Skip and documented in #40075. Many of them are probably bugs. One clarifying test case added to both text/template and html/template. No changes to the package itself. Change-Id: Ifefad83d647db846040d24c2741a0244b00ade82 Reviewed-on: https://go-review.googlesource.com/c/go/+/241084 Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Rob Pike <r@golang.org>
2020-07-13cmd/go: include GOMODCACHE in 'go help environment'Jay Conrod
Updates #34527 Fixes #40089 Change-Id: Ie9c8573536e5c31e874d755f4d888ffc805b796f Reviewed-on: https://go-review.googlesource.com/c/go/+/241275 Run-TryBot: Jay Conrod <jayconrod@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Michael Matloob <matloob@golang.org>
2020-07-10net: hangup TCP connection after Dial timeout in Plan 9Fazlul Shahriar
After Dial timeout, force close the TCP connection by writing "hangup" to the control file. This unblocks the "connect" command if the connection is taking too long to establish, and frees up the control file FD. Fixes #40118 Change-Id: I1cef8539cd9fe0793e32b49c9d0ef636b4b26e1d Reviewed-on: https://go-review.googlesource.com/c/go/+/241638 Run-TryBot: David du Colombier <0intro@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: David du Colombier <0intro@gmail.com>
2020-07-09doc/go1.15: fix TODO about -buildmode=pieAustin Clements
Updates #37419. Change-Id: If77067eb348de47a4b101325de8a43502383b6d3 Reviewed-on: https://go-review.googlesource.com/c/go/+/241740 Reviewed-by: Cherry Zhang <cherryyz@google.com>
2020-07-09net/textproto: correct documentation of empty line handlingNorman B. Lancaster
Fixes #32493 Change-Id: I9c93791c4cc5c0c14556802733066407de3181ca Reviewed-on: https://go-review.googlesource.com/c/go/+/185542 TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-07-09doc/go1.15: add line for testing streaming changeJean de Klerk
Updates #37419. Updates #38458. Updates #24929. Change-Id: I793bb20fa9db4432fc3a5b69956b7108e4695081 Reviewed-on: https://go-review.googlesource.com/c/go/+/241660 Run-TryBot: Jean de Klerk <deklerk@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2020-07-08crypto/x509/internal/macos: rename package to lowercaseFilippo Valsorda
Also add a test to lock in this policy. Fixes #40065 Change-Id: Iedc4586f2f5598046d84132a8f3bba8f2e93ddc2 Reviewed-on: https://go-review.googlesource.com/c/go/+/241274 Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-07-08runtime: mark OpenBSD raise function nosplitIan Lance Taylor
It is called by the signal handler before switching to gsignal (sigtrampgo -> sigfwdgo -> dieFromSignal -> raise) which means that it must not split the stack. All other instances of raise are already marked nosplit. Fixes #40076 Change-Id: I4794491331af48c46d0d8ebc82d34c6483f0e6cd Reviewed-on: https://go-review.googlesource.com/c/go/+/241121 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Cherry Zhang <cherryyz@google.com>
2020-07-08os: fix regression with handling of nil *FileJoe Tsai
Use of a nil *File as an argument should not result in a panic, but result in the ErrInvalid error being returned. Fix the copy_file_range implementation to preserve this semantic. Fixes #40115 Change-Id: Iad5ac39664a3efb7964cf55685be636940a8db13 Reviewed-on: https://go-review.googlesource.com/c/go/+/241417 Reviewed-by: Ian Lance Taylor <iant@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-07-08crypto: fix PKCS space in docsKatie Hockman
Change-Id: Iee53acb963a889410f8c6daaa9a7841f1b12c6fb Reviewed-on: https://go-review.googlesource.com/c/go/+/241497 Run-TryBot: Katie Hockman <katie@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2020-07-08doc/editors.html: update VS Code Go extension urlHana (Hyang-Ah) Kim
Change-Id: I7aa73861de053db6b424f113733de9caba19145b Reviewed-on: https://go-review.googlesource.com/c/go/+/241086 Reviewed-by: Andrew Bonventre <andybons@golang.org>
2020-07-08A+C: add Kush Patel (corporate CLA for Hootsuite Inc)Kush Patel
I'm from Hootsuite. We're a Canadian tech company who provides products and services to businesses, organizations and individuals to really help them succeed on social. We have leveraged Go in our stack for the past 4+ years. I am super happy to give back to Go on behalf of Hootsuite through a small contribution to pkgsite (with a few more in the works). We love this project and we love open source :) Hopefully we can give back more in the future! Kush Change-Id: Id534a41d78e17e1fa48a8ddecd1ca110cf812388 GitHub-Last-Rev: 297b8b06e75c3ce485f62677ce4591c5cabe8008 GitHub-Pull-Request: golang/go#40088 Reviewed-on: https://go-review.googlesource.com/c/go/+/241218 Reviewed-by: Julie Qiu <julie@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-07-07crypto/tls: relax the docs of InsecureSkipVerifyFilippo Valsorda
Fixes #39074 Change-Id: I72ec95f4b190253bb82d52a03a769b0399170b93 Reviewed-on: https://go-review.googlesource.com/c/go/+/239746 Reviewed-by: Katie Hockman <katie@golang.org>
2020-07-07net: correct address when listening on IPv4zero tcp4/udp4 on Plan 9Fazlul Shahriar
Since Plan 9 doesn't allow us to listen on 0.0.0.0, the Listener address that's read in from /net is the IPv6 address ::. Convert this address to 0.0.0.0 when the network is tcp4 or udp4. Fixes #40045 Change-Id: Icfb69b823e5b80603742d23c3762a812996fe43f Reviewed-on: https://go-review.googlesource.com/c/go/+/240918 Run-TryBot: David du Colombier <0intro@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: David du Colombier <0intro@gmail.com>
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion