cmd/go/internal/load: disallow import of mod/...

If that import succeeded it would address the module cache.

Change-Id: I3aaa0764c1cdcb1f7099b266edb2d56f53fda489
Reviewed-on: https://go-review.googlesource.com/122259
Reviewed-by: Bryan C. Mills <bcmills@google.com>

vendor/cmd/go/internal/load/pkg.go

diff --git a/vendor/cmd/go/internal/load/pkg.go b/vendor/cmd/go/internal/load/pkg.go
index 8ccfb77..0a8eae6 100644
--- a/vendor/cmd/go/internal/load/pkg.go
+++ b/vendor/cmd/go/internal/load/pkg.go
@@ -425,6 +425,23 @@
 	stk.Push(path)
 	defer stk.Pop()
 
+	if strings.HasPrefix(path, "mod/") {
+		// Paths beginning with "mod/" might accidentally
+		// look in the module cache directory tree in $GOPATH/src/mod/.
+		// This prefix is owned by the Go core for possible use in the
+		// standard library (since it does not begin with a domain name),
+		// so it's OK to disallow entirely.
+		return &Package{
+			PackagePublic: PackagePublic{
+				ImportPath: path,
+				Error: &PackageError{
+					ImportStack: stk.Copy(),
+					Err:         fmt.Sprintf("disallowed import path %q", path),
+				},
+			},
+		}
+	}
+
 	// Determine canonical identifier for this package.
 	// For a local import the identifier is the pseudo-import path
 	// we create from the full directory to the package.

vendor/cmd/go/vgo_test.go

diff --git a/vendor/cmd/go/vgo_test.go b/vendor/cmd/go/vgo_test.go
index fec216f..03840c0 100644
--- a/vendor/cmd/go/vgo_test.go
+++ b/vendor/cmd/go/vgo_test.go
@@ -102,6 +102,15 @@
 	}
 }
 
+func TestImportModFails(t *testing.T) {
+	tg := testgo(t)
+	tg.setenv("GO111MODULE", "off") // testing GOPATH mode
+	defer tg.cleanup()
+
+	tg.runFail("list", "mod/foo")
+	tg.grepStderr(`disallowed import path`, "expected disallowed because of module cache")
+}
+
 func TestModEdit(t *testing.T) {
 	// Test that local replacements work
 	// and that they can use a dummy name