commit | 5c622a5bf3cf3eda45384171bb75591a18e89855 | [log] [tgz] |
---|---|---|
author | Russ Cox <rsc@golang.org> | Mon Jul 16 00:47:24 2018 -0400 |
committer | Russ Cox <rsc@golang.org> | Wed Jul 18 02:08:59 2018 +0000 |
tree | 098f18dd04421d5bdc4bb53f3b3481dcc7cb6181 | |
parent | 5760ffc7ef4c292acf0f85a04e2496a4af504ddb [diff] |
cmd/go/internal/modfetch: restrict file names in zip files, avoid case-insensitive collisions Within the zip file for a given module, disallow names that are invalid on various operating systems (mostly Windows), and disallow having two different paths that are case-fold-equivalent. Disallowing different case-fold-equivalent paths means the zip file content is safe for case-insensitive file systems. There is more we could do to relax the rules later, but I think this should be enough to avoid digging a hole in the early days of modules that's hard to climb out of later. In tests on my repo test corpus, the repos now rejected are: github.com/vjeantet/goldap v0.0.0-20160521203625-ea702ca12a40 "doc/RFC 4511 - LDAP: The Protocol.txt": invalid char ':' github.com/ChimeraCoder/anaconda v0.0.0-20160509014622-91bfbf5de08d "json/statuses/show.json?id=404409873170841600": invalid char '?' github.com/bmatcuk/doublestar "test/a☺b": invalid char '☺' github.com/kubernetes-incubator/service-catalog v0.1.10 "cmd/svcat/testdata/responses/clusterserviceclasses?fieldSelector=spec.externalName=user-provided-service.json": invalid char '?' The : and ? are reserved on Windows, and the : is half-reserved (and quite confusing) on macOS. The ☺ is perhaps an overreach, but I am not convinced that allowing all of category So is safe; certainly Sk is not. Change-Id: I83b6ac47ce6c442f726f1036bccccdb15553c0af Reviewed-on: https://go-review.googlesource.com/124380 Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com>
Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.
Gopher image by Renee French, licensed under Creative Commons 3.0 Attributions license.
Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.
Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.
Official binary distributions are available at https://golang.org/dl/.
After downloading a binary release, visit https://golang.org/doc/install or load doc/install.html in your web browser for installation instructions.
If a binary distribution is not available for your combination of operating system and architecture, visit https://golang.org/doc/install/source or load doc/install-source.html in your web browser for source installation instructions.
Go is the work of thousands of contributors. We appreciate your help!
To contribute, please read the contribution guidelines: https://golang.org/doc/contribute.html
Note that the Go project uses the issue tracker for bug reports and proposals only. See https://golang.org/wiki/Questions for a list of places to ask questions about the Go language.