)]}'
{
  "commit": "1dcb5836ad2c60776561da2923c70576ba2eefc6",
  "tree": "336ea77437d856cf607cdcd70b2746ca97d65e55",
  "parents": [
    "b2d3d6e676450cc1a5d5a611d3711dce2800bc0d"
  ],
  "author": {
    "name": "Russ Cox",
    "email": "rsc@golang.org",
    "time": "Thu Feb 01 14:07:21 2018 -0500"
  },
  "committer": {
    "name": "Russ Cox",
    "email": "rsc@google.com",
    "time": "Wed Feb 07 15:35:57 2018 +0000"
  },
  "message": "cmd/go: accept only limited compiler and linker flags in #cgo directives\n\nBoth gcc and clang accept an option -fplugin\u003dcode.so to load\na plugin from the ELF shared object file code.so.\nObviously that plugin can then do anything it wants\nduring the build. This is contrary to the goal of \"go get\"\nnever running untrusted code during the build.\n(What happens if you choose to run the result of\nthe build is your responsibility.)\n\nDisallow this behavior by only allowing a small set of\nknown command-line flags in #cgo CFLAGS directives\n(and #cgo LDFLAGS, etc).\n\nThe new restrictions can be adjusted by the environment\nvariables CGO_CFLAGS_ALLOW, CGO_CFLAGS_DISALLOW,\nand so on. See the documentation.\n\nIn addition to excluding cgo-defined flags, we also have to\nmake sure that when we pass file names on the command\nline, they don\u0027t look like flags. So we now refuse to build\npackages containing suspicious file names like -x.go.\n\nA wrinkle in all this is that GNU binutils uniformly accept\n@foo on the command line to mean \"if the file foo exists,\nthen substitute its contents for @foo in the command line\".\nSo we must also reject @x.go, flags and flag arguments\nbeginning with @, and so on.\n\nFixes #23672, CVE-2018-6574.\n\nChange-Id: I59e7c1355155c335a5c5ae0d2cf8fa7aa313940a\nReviewed-on: https://team-review.git.corp.google.com/209949\nReviewed-by: Ian Lance Taylor \u003ciant@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "61bbcd2957747188bee25b559cd71ed22416abab",
      "old_mode": 33188,
      "old_path": "misc/cgo/errors/src/err1.go",
      "new_id": "2c232cf58a788cc7956298530f35fc928e64e73e",
      "new_mode": 33188,
      "new_path": "misc/cgo/errors/src/err1.go"
    },
    {
      "type": "modify",
      "old_id": "8e4cd88b37c2f7abe219fd8383bab44183ecba95",
      "old_mode": 33188,
      "old_path": "src/cmd/cgo/doc.go",
      "new_id": "c16b63a313bb96c6dae51b435b8216ce97a85e20",
      "new_mode": 33188,
      "new_path": "src/cmd/cgo/doc.go"
    },
    {
      "type": "modify",
      "old_id": "dcd5f20dfd2cf76e568b6403e5e49a01dca154ce",
      "old_mode": 33188,
      "old_path": "src/cmd/compile/internal/gc/noder.go",
      "new_id": "fff04bcbefb7f534897c61af10039adc2d7fd4e9",
      "new_mode": 33188,
      "new_path": "src/cmd/compile/internal/gc/noder.go"
    },
    {
      "type": "modify",
      "old_id": "e80d466d35240aeee7a04d6a9fc7172b1a3a0cdc",
      "old_mode": 33188,
      "old_path": "src/cmd/dist/build.go",
      "new_id": "49ed80033e6b59fdd7063d0334d4f032f6e85d2f",
      "new_mode": 33188,
      "new_path": "src/cmd/dist/build.go"
    },
    {
      "type": "modify",
      "old_id": "91657eb74c14a2f4e237eb0eac3e7720dc942e32",
      "old_mode": 33188,
      "old_path": "src/cmd/go/alldocs.go",
      "new_id": "7557647ea604334d809c20c5acc80d450331da1e",
      "new_mode": 33188,
      "new_path": "src/cmd/go/alldocs.go"
    },
    {
      "type": "modify",
      "old_id": "92600b6238fcd5c32fa2236e5f77bef180c735df",
      "old_mode": 33188,
      "old_path": "src/cmd/go/go_test.go",
      "new_id": "3972d79e3f627664c828b1c041c528e1168a4213",
      "new_mode": 33188,
      "new_path": "src/cmd/go/go_test.go"
    },
    {
      "type": "modify",
      "old_id": "fa19bebe218fcf8fc130cba5f123d8dcd330dd51",
      "old_mode": 33188,
      "old_path": "src/cmd/go/internal/envcmd/env.go",
      "new_id": "603f7b5060c98522a930c380effa9e7eaa8b0581",
      "new_mode": 33188,
      "new_path": "src/cmd/go/internal/envcmd/env.go"
    },
    {
      "type": "modify",
      "old_id": "4ebf206078942777109c63b14dbf7424848da4d6",
      "old_mode": 33188,
      "old_path": "src/cmd/go/internal/help/helpdoc.go",
      "new_id": "c39af796049fe77712eba02afdde3ff93c2dc074",
      "new_mode": 33188,
      "new_path": "src/cmd/go/internal/help/helpdoc.go"
    },
    {
      "type": "modify",
      "old_id": "eaff7177b6fffffa135fc858528fccdac6538368",
      "old_mode": 33188,
      "old_path": "src/cmd/go/internal/load/pkg.go",
      "new_id": "bbd75bc9b6774d9fd467922140f78e22bb7b89fb",
      "new_mode": 33188,
      "new_path": "src/cmd/go/internal/load/pkg.go"
    },
    {
      "type": "modify",
      "old_id": "58bab5cb2f8273ca345cd5c57c7e192b1be38a35",
      "old_mode": 33188,
      "old_path": "src/cmd/go/internal/work/exec.go",
      "new_id": "a5ab75f6a82bfc158aac84482c1e73d56393e6c6",
      "new_mode": 33188,
      "new_path": "src/cmd/go/internal/work/exec.go"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "fee5beeb15f3ea342384770d686814fe7eacba36",
      "new_mode": 33188,
      "new_path": "src/cmd/go/internal/work/security.go"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "739ab5a6ee63b5b82aa3b61633e6e351457c1118",
      "new_mode": 33188,
      "new_path": "src/cmd/go/internal/work/security_test.go"
    }
  ]
}