From 9a8006764336b71cd28ff313db1558865e6afc47 Mon Sep 17 00:00:00 2001 From: "Bryan C. Mills" Date: Tue, 4 Dec 2018 17:00:19 -0500 Subject: [release-branch.go1.10-security] cmd/go/internal/get: relax pathOK check to allow any letter This fixes a regression of #18660 with the new path checks. Change-Id: I07cd248392ba8f5f9b1614b79a323cca1ad1d46d Reviewed-on: https://team-review.git.corp.google.com/c/372708 Reviewed-by: Dmitri Shuralyov --- src/cmd/go/internal/get/path.go | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/src/cmd/go/internal/get/path.go b/src/cmd/go/internal/get/path.go index c8072b25fd..d443bd28a9 100644 --- a/src/cmd/go/internal/get/path.go +++ b/src/cmd/go/internal/get/path.go @@ -12,10 +12,13 @@ import ( ) // The following functions are copied verbatim from cmd/go/internal/module/module.go, -// with one change to additionally reject Windows short-names. +// with a change to additionally reject Windows short-names, +// and one to accept arbitrary letters (golang.org/issue/29101). // // TODO(bcmills): After the call site for this function is backported, // consolidate this back down to a single copy. +// +// NOTE: DO NOT MERGE THESE UNTIL WE DECIDE ABOUT ARBITRARY LETTERS IN MODULE MODE. // CheckImportPath checks that an import path is valid. func CheckImportPath(path string) error { @@ -120,10 +123,8 @@ func checkElem(elem string, fileName bool) error { } // pathOK reports whether r can appear in an import path element. -// Paths can be ASCII letters, ASCII digits, and limited ASCII punctuation: + - . _ and ~. -// This matches what "go get" has historically recognized in import paths. -// TODO(rsc): We would like to allow Unicode letters, but that requires additional -// care in the safe encoding (see note below). +// +// NOTE: This function DIVERGES from module mode pathOK by accepting Unicode letters. func pathOK(r rune) bool { if r < utf8.RuneSelf { return r == '+' || r == '-' || r == '.' || r == '_' || r == '~' || @@ -131,7 +132,7 @@ func pathOK(r rune) bool { 'A' <= r && r <= 'Z' || 'a' <= r && r <= 'z' } - return false + return unicode.IsLetter(r) } // fileNameOK reports whether r can appear in a file name. -- cgit v1.2.3-54-g00ecf