all: use os.Root for handling user input The playground accepts arbitrary user input in the form of a txtar file in the /compile endpoint: https://golang.org/x/tools/txtar A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke `go vet` on the playground host did not correctly lockdown the execution env. This permitted a Go process to make a read for an environment configuration file rooted in the playground host's $HOME. Together, a well-crafted go env file and the `go vet` invocation could lead to remote code execution in the playground host itself. We now use `os.Root` to ensure that user-provided archives cannot escape the execution context. Thanks to splitline (@splitline) from DEVCORE Research Team for reporting this issue. For CVE-2026-94445 For golang/go#81737 Change-Id: Idc6fcba402502788a0c911b612f7dd6c9506ec36 Reviewed-on: https://go-review.googlesource.com/c/playground/+/838485 Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <nsh@golang.org> Auto-Submit: Neal Patel <nealpatel@google.com>
This subrepository holds the source for the Go playground: https://go.dev/play/
# build the image docker build -t golang/playground .
docker run --name=play --rm -p 8080:8080 golang/playground & # run some Go code cat /path/to/code.go | go run client.go | curl -s --upload-file - localhost:8080/compile
To run the “gotip” version of the playground, set GOTIP=true in your environment (via -e GOTIP=true if using docker run).
Playground releases automatically triggered when new Go repository tags are pushed to GitHub, or when master is pushed on the playground repository.
For details, see deploy/go_trigger.yaml, deploy/playground_trigger.yaml, and deploy/deploy.json.
Changes to the trigger configuration can be made to the YAML files, or in the GCP UI, which should be kept in sync using the push-cloudbuild-triggers and pull-cloudbuild-triggers make targets.
The Cloud Build configuration will always build and deploy with the latest supported release of Go.
gcloud --project=golang-org builds submit --config deploy/deploy.json .
To deploy the “Go tip” version of the playground, which uses the latest development build, use deploy_gotip.json instead:
gcloud --project=golang-org builds submit --config deploy/deploy_gotip.json .
Building the playground Docker container takes more than the default 10 minute time limit of cloud build, so increase its timeout first (note, app/cloud_build_timeout is a global configuration value):
gcloud config set app/cloud_build_timeout 1200 # 20 mins
Alternatively, to avoid Cloud Build and build locally:
make docker docker tag golang/playground:latest gcr.io/golang-org/playground:latest docker push gcr.io/golang-org/playground:latest gcloud --project=golang-org --account=you@google.com app deploy app.yaml --image-url=gcr.io/golang-org/playground:latest
Then:
gcloud --project=golang-org --account=you@google.com app deploy app.yaml
To submit changes to this repository, see https://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/playground.