| commit | 6e50991d2a38058d0824f8b086677fbe9774c9f9 | [log] [tgz] |
|---|---|---|
| author | Joe Tsai <joetsai@digital-static.net> | Fri Aug 20 12:50:02 2021 -0700 |
| committer | Joe Tsai <joetsai@digital-static.net> | Sat Aug 21 18:23:58 2021 +0000 |
| tree | 5284a7438243dca0c5a4e2a012d076d7a4cf50da | |
| parent | 8fff20ffebadfea2c5c3dd58f7007246f3408495 [diff] |
strconv: reject surrogate halves in Unquote Unquote implements unescaping a "single-quoted, doubled-quoted, or backquoted Go string literal". Therefore, it should reject anything that the Go specification explicitly forbids. The section on "Rune literals" explicitly rejects rune values "above 0x10FFFF and surrogate halves". We properly checked for the previous condition, but were failing to check for the latter. In general, "r > utf8.MaxRune" is probably the wrong check, while !utf8.ValidRune(r) is the more correct check. We make changes to both UnquoteChar and appendEscapedRune to use the correct check. The change to appendEscapedRune is technically a noop since callers of that function already guarantee that the provided rune is valid. Fixes #47853 Change-Id: Ib8977e56b91943ec8ada821b8d217b5e9a66f950 Reviewed-on: https://go-review.googlesource.com/c/go/+/343877 Trust: Joe Tsai <joetsai@digital-static.net> Run-TryBot: Joe Tsai <joetsai@digital-static.net> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Rob Pike <r@golang.org>
Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.
Gopher image by Renee French, licensed under Creative Commons 3.0 Attributions license.
Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.
Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.
Official binary distributions are available at https://golang.org/dl/.
After downloading a binary release, visit https://golang.org/doc/install for installation instructions.
If a binary distribution is not available for your combination of operating system and architecture, visit https://golang.org/doc/install/source for source installation instructions.
Go is the work of thousands of contributors. We appreciate your help!
To contribute, please read the contribution guidelines at https://golang.org/doc/contribute.html.
Note that the Go project uses the issue tracker for bug reports and proposals only. See https://golang.org/wiki/Questions for a list of places to ask questions about the Go language.