commit | 76421de6569b7c29b3a596fee30867a1ac0f7251 | [log] [tgz] |
---|---|---|
author | Filippo Valsorda <filippo@golang.org> | Fri Mar 30 17:31:10 2018 -0400 |
committer | Filippo Valsorda <filippo@golang.org> | Mon Apr 02 15:36:52 2018 +0000 |
tree | 1c8e663a15b453f8970ba14bc1211bd920aa76c4 | |
parent | 3e3b3b98b3d99a88956f4438e3f35f9f0f07fbf6 [diff] |
cmd/go/internal/dirhash: disallow newlines in filenames for security This prevents collision attacks where crafted filenames are used to generate different directories with the same h1 hash. Change-Id: Ie93a54914b56589d237e39d37361b259dab58771 Reviewed-on: https://go-review.googlesource.com/103776 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This repository holds a prototype of what the go command might look like with integrated support for package versioning.
See research.swtch.com/vgo for documents about the design.
Use go get -u golang.org/x/vgo
.
You can also manually git clone the repository to $GOPATH/src/golang.org/x/vgo
.
See CONTRIBUTING.md.
This is still a very early prototype. You are likely to run into bugs. Please file bugs in the main Go issue tracker, golang.org/issue, and put the prefix x/vgo:
in the issue title.
Thank you.