mirror of
https://git.yoctoproject.org/poky
synced 2026-04-20 09:32:13 +02:00
go: fix CVE-2023-24531
Backport required patches from go1.21 to fix CVE-2023-24531. (From OE-Core rev: 6d892c52bd5806507a05e8b6f749c54bbd9e9da6) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Sakib Sajal
committed by
Steve Sakoman
Steve Sakoman
parent
1ba43f2c88
commit
1aae734721
@@ -1,6 +1,6 @@
|
||||
require go-common.inc
|
||||
|
||||
FILESEXTRAPATHS:prepend := "${FILE_DIRNAME}/go-1.19:${FILE_DIRNAME}/go-1.18:"
|
||||
FILESEXTRAPATHS:prepend := "${FILE_DIRNAME}/go-1.21:${FILE_DIRNAME}/go-1.19:${FILE_DIRNAME}/go-1.18:"
|
||||
|
||||
LIC_FILES_CHKSUM = "file://LICENSE;md5=5d4950ecb7b26d2c5e4e7b4e0dd74707"
|
||||
|
||||
@@ -40,6 +40,8 @@ SRC_URI += "\
|
||||
file://CVE-2023-24536_1.patch \
|
||||
file://CVE-2023-24536_2.patch \
|
||||
file://CVE-2023-24536_3.patch \
|
||||
file://CVE-2023-24531_1.patch \
|
||||
file://CVE-2023-24531_2.patch \
|
||||
"
|
||||
SRC_URI[main.sha256sum] = "a1a48b23afb206f95e7bbaa9b898d965f90826f6f1d1fc0c1d784ada0cd300fd"
|
||||
|
||||
|
||||
252
meta/recipes-devtools/go/go-1.21/CVE-2023-24531_1.patch
Normal file
252
meta/recipes-devtools/go/go-1.21/CVE-2023-24531_1.patch
Normal file
@@ -0,0 +1,252 @@
|
||||
From 0f717b5f7d32bb660c01ec0366bd53c9b4c5ab5d Mon Sep 17 00:00:00 2001
|
||||
From: Michael Matloob <matloob@golang.org>
|
||||
Date: Mon, 24 Apr 2023 16:57:28 -0400
|
||||
Subject: [PATCH 1/2] cmd/go: sanitize go env outputs
|
||||
|
||||
go env, without any arguments, outputs the environment variables in
|
||||
the form of a script that can be run on the host OS. On Unix, single
|
||||
quote the strings and place single quotes themselves outside the
|
||||
single quoted strings. On windows use the set "var=val" syntax with
|
||||
the quote starting before the variable.
|
||||
|
||||
Fixes #58508
|
||||
|
||||
Change-Id: Iecd379a4af7285ea9b2024f0202250c74fd9a2bd
|
||||
Reviewed-on: https://go-review.googlesource.com/c/go/+/488375
|
||||
TryBot-Result: Gopher Robot <gobot@golang.org>
|
||||
Reviewed-by: Michael Matloob <matloob@golang.org>
|
||||
Reviewed-by: Damien Neil <dneil@google.com>
|
||||
Run-TryBot: Michael Matloob <matloob@golang.org>
|
||||
Reviewed-by: Bryan Mills <bcmills@google.com>
|
||||
Reviewed-by: Quim Muntal <quimmuntal@gmail.com>
|
||||
|
||||
CVE: CVE-2023-24531
|
||||
Upstream-Status: Backport [f379e78951a405e7e99a60fb231eeedbf976c108]
|
||||
|
||||
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
|
||||
---
|
||||
src/cmd/go/internal/envcmd/env.go | 60 ++++++++++++-
|
||||
src/cmd/go/internal/envcmd/env_test.go | 94 +++++++++++++++++++++
|
||||
src/cmd/go/testdata/script/env_sanitize.txt | 5 ++
|
||||
3 files changed, 157 insertions(+), 2 deletions(-)
|
||||
create mode 100644 src/cmd/go/internal/envcmd/env_test.go
|
||||
create mode 100644 src/cmd/go/testdata/script/env_sanitize.txt
|
||||
|
||||
diff --git a/src/cmd/go/internal/envcmd/env.go b/src/cmd/go/internal/envcmd/env.go
|
||||
index 43b94e7..0ce8843 100644
|
||||
--- a/src/cmd/go/internal/envcmd/env.go
|
||||
+++ b/src/cmd/go/internal/envcmd/env.go
|
||||
@@ -6,6 +6,7 @@
|
||||
package envcmd
|
||||
|
||||
import (
|
||||
+ "bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
@@ -17,6 +18,7 @@ import (
|
||||
"runtime"
|
||||
"sort"
|
||||
"strings"
|
||||
+ "unicode"
|
||||
"unicode/utf8"
|
||||
|
||||
"cmd/go/internal/base"
|
||||
@@ -379,9 +381,12 @@ func checkBuildConfig(add map[string]string, del map[string]bool) error {
|
||||
func PrintEnv(w io.Writer, env []cfg.EnvVar) {
|
||||
for _, e := range env {
|
||||
if e.Name != "TERM" {
|
||||
+ if runtime.GOOS != "plan9" && bytes.Contains([]byte(e.Value), []byte{0}) {
|
||||
+ base.Fatalf("go: internal error: encountered null byte in environment variable %s on non-plan9 platform", e.Name)
|
||||
+ }
|
||||
switch runtime.GOOS {
|
||||
default:
|
||||
- fmt.Fprintf(w, "%s=\"%s\"\n", e.Name, e.Value)
|
||||
+ fmt.Fprintf(w, "%s=%s\n", e.Name, shellQuote(e.Value))
|
||||
case "plan9":
|
||||
if strings.IndexByte(e.Value, '\x00') < 0 {
|
||||
fmt.Fprintf(w, "%s='%s'\n", e.Name, strings.ReplaceAll(e.Value, "'", "''"))
|
||||
@@ -392,17 +397,68 @@ func PrintEnv(w io.Writer, env []cfg.EnvVar) {
|
||||
if x > 0 {
|
||||
fmt.Fprintf(w, " ")
|
||||
}
|
||||
+ // TODO(#59979): Does this need to be quoted like above?
|
||||
fmt.Fprintf(w, "%s", s)
|
||||
}
|
||||
fmt.Fprintf(w, ")\n")
|
||||
}
|
||||
case "windows":
|
||||
- fmt.Fprintf(w, "set %s=%s\n", e.Name, e.Value)
|
||||
+ if hasNonGraphic(e.Value) {
|
||||
+ base.Errorf("go: stripping unprintable or unescapable characters from %%%q%%", e.Name)
|
||||
+ }
|
||||
+ fmt.Fprintf(w, "set %s=%s\n", e.Name, batchEscape(e.Value))
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+func hasNonGraphic(s string) bool {
|
||||
+ for _, c := range []byte(s) {
|
||||
+ if c == '\r' || c == '\n' || (!unicode.IsGraphic(rune(c)) && !unicode.IsSpace(rune(c))) {
|
||||
+ return true
|
||||
+ }
|
||||
+ }
|
||||
+ return false
|
||||
+}
|
||||
+
|
||||
+func shellQuote(s string) string {
|
||||
+ var b bytes.Buffer
|
||||
+ b.WriteByte('\'')
|
||||
+ for _, x := range []byte(s) {
|
||||
+ if x == '\'' {
|
||||
+ // Close the single quoted string, add an escaped single quote,
|
||||
+ // and start another single quoted string.
|
||||
+ b.WriteString(`'\''`)
|
||||
+ } else {
|
||||
+ b.WriteByte(x)
|
||||
+ }
|
||||
+ }
|
||||
+ b.WriteByte('\'')
|
||||
+ return b.String()
|
||||
+}
|
||||
+
|
||||
+func batchEscape(s string) string {
|
||||
+ var b bytes.Buffer
|
||||
+ for _, x := range []byte(s) {
|
||||
+ if x == '\r' || x == '\n' || (!unicode.IsGraphic(rune(x)) && !unicode.IsSpace(rune(x))) {
|
||||
+ b.WriteRune(unicode.ReplacementChar)
|
||||
+ continue
|
||||
+ }
|
||||
+ switch x {
|
||||
+ case '%':
|
||||
+ b.WriteString("%%")
|
||||
+ case '<', '>', '|', '&', '^':
|
||||
+ // These are special characters that need to be escaped with ^. See
|
||||
+ // https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1.
|
||||
+ b.WriteByte('^')
|
||||
+ b.WriteByte(x)
|
||||
+ default:
|
||||
+ b.WriteByte(x)
|
||||
+ }
|
||||
+ }
|
||||
+ return b.String()
|
||||
+}
|
||||
+
|
||||
func printEnvAsJSON(env []cfg.EnvVar) {
|
||||
m := make(map[string]string)
|
||||
for _, e := range env {
|
||||
diff --git a/src/cmd/go/internal/envcmd/env_test.go b/src/cmd/go/internal/envcmd/env_test.go
|
||||
new file mode 100644
|
||||
index 0000000..32d99fd
|
||||
--- /dev/null
|
||||
+++ b/src/cmd/go/internal/envcmd/env_test.go
|
||||
@@ -0,0 +1,94 @@
|
||||
+// Copyright 2022 The Go Authors. All rights reserved.
|
||||
+// Use of this source code is governed by a BSD-style
|
||||
+// license that can be found in the LICENSE file.
|
||||
+
|
||||
+//go:build unix || windows
|
||||
+
|
||||
+package envcmd
|
||||
+
|
||||
+import (
|
||||
+ "bytes"
|
||||
+ "cmd/go/internal/cfg"
|
||||
+ "fmt"
|
||||
+ "internal/testenv"
|
||||
+ "os"
|
||||
+ "os/exec"
|
||||
+ "path/filepath"
|
||||
+ "runtime"
|
||||
+ "testing"
|
||||
+ "unicode"
|
||||
+)
|
||||
+
|
||||
+func FuzzPrintEnvEscape(f *testing.F) {
|
||||
+ f.Add(`$(echo 'cc"'; echo 'OOPS="oops')`)
|
||||
+ f.Add("$(echo shell expansion 1>&2)")
|
||||
+ f.Add("''")
|
||||
+ f.Add(`C:\"Program Files"\`)
|
||||
+ f.Add(`\\"Quoted Host"\\share`)
|
||||
+ f.Add("\xfb")
|
||||
+ f.Add("0")
|
||||
+ f.Add("")
|
||||
+ f.Add("''''''''")
|
||||
+ f.Add("\r")
|
||||
+ f.Add("\n")
|
||||
+ f.Add("E,%")
|
||||
+ f.Fuzz(func(t *testing.T, s string) {
|
||||
+ t.Parallel()
|
||||
+
|
||||
+ for _, c := range []byte(s) {
|
||||
+ if c == 0 {
|
||||
+ t.Skipf("skipping %q: contains a null byte. Null bytes can't occur in the environment"+
|
||||
+ " outside of Plan 9, which has different code path than Windows and Unix that this test"+
|
||||
+ " isn't testing.", s)
|
||||
+ }
|
||||
+ if c > unicode.MaxASCII {
|
||||
+ t.Skipf("skipping %#q: contains a non-ASCII character %q", s, c)
|
||||
+ }
|
||||
+ if !unicode.IsGraphic(rune(c)) && !unicode.IsSpace(rune(c)) {
|
||||
+ t.Skipf("skipping %#q: contains non-graphic character %q", s, c)
|
||||
+ }
|
||||
+ if runtime.GOOS == "windows" && c == '\r' || c == '\n' {
|
||||
+ t.Skipf("skipping %#q on Windows: contains unescapable character %q", s, c)
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ var b bytes.Buffer
|
||||
+ if runtime.GOOS == "windows" {
|
||||
+ b.WriteString("@echo off\n")
|
||||
+ }
|
||||
+ PrintEnv(&b, []cfg.EnvVar{{Name: "var", Value: s}})
|
||||
+ var want string
|
||||
+ if runtime.GOOS == "windows" {
|
||||
+ fmt.Fprintf(&b, "echo \"%%var%%\"\n")
|
||||
+ want += "\"" + s + "\"\r\n"
|
||||
+ } else {
|
||||
+ fmt.Fprintf(&b, "printf '%%s\\n' \"$var\"\n")
|
||||
+ want += s + "\n"
|
||||
+ }
|
||||
+ scriptfilename := "script.sh"
|
||||
+ if runtime.GOOS == "windows" {
|
||||
+ scriptfilename = "script.bat"
|
||||
+ }
|
||||
+ scriptfile := filepath.Join(t.TempDir(), scriptfilename)
|
||||
+ if err := os.WriteFile(scriptfile, b.Bytes(), 0777); err != nil {
|
||||
+ t.Fatal(err)
|
||||
+ }
|
||||
+ t.Log(b.String())
|
||||
+ var cmd *exec.Cmd
|
||||
+ if runtime.GOOS == "windows" {
|
||||
+ cmd = testenv.Command(t, "cmd.exe", "/C", scriptfile)
|
||||
+ } else {
|
||||
+ cmd = testenv.Command(t, "sh", "-c", scriptfile)
|
||||
+ }
|
||||
+ out, err := cmd.Output()
|
||||
+ t.Log(string(out))
|
||||
+ if err != nil {
|
||||
+ t.Fatal(err)
|
||||
+ }
|
||||
+
|
||||
+ if string(out) != want {
|
||||
+ t.Fatalf("output of running PrintEnv script and echoing variable: got: %q, want: %q",
|
||||
+ string(out), want)
|
||||
+ }
|
||||
+ })
|
||||
+}
|
||||
diff --git a/src/cmd/go/testdata/script/env_sanitize.txt b/src/cmd/go/testdata/script/env_sanitize.txt
|
||||
new file mode 100644
|
||||
index 0000000..cc4d23a
|
||||
--- /dev/null
|
||||
+++ b/src/cmd/go/testdata/script/env_sanitize.txt
|
||||
@@ -0,0 +1,5 @@
|
||||
+env GOFLAGS='$(echo ''cc"''; echo ''OOPS="oops'')'
|
||||
+go env
|
||||
+[GOOS:darwin] stdout 'GOFLAGS=''\$\(echo ''\\''''cc"''\\''''; echo ''\\''''OOPS="oops''\\''''\)'''
|
||||
+[GOOS:linux] stdout 'GOFLAGS=''\$\(echo ''\\''''cc"''\\''''; echo ''\\''''OOPS="oops''\\''''\)'''
|
||||
+[GOOS:windows] stdout 'set GOFLAGS=\$\(echo ''cc"''; echo ''OOPS="oops''\)'
|
||||
--
|
||||
2.35.5
|
||||
|
||||
47
meta/recipes-devtools/go/go-1.21/CVE-2023-24531_2.patch
Normal file
47
meta/recipes-devtools/go/go-1.21/CVE-2023-24531_2.patch
Normal file
@@ -0,0 +1,47 @@
|
||||
From b2624f973692ca093348395c2418d1c422f2a162 Mon Sep 17 00:00:00 2001
|
||||
From: miller <millerresearch@gmail.com>
|
||||
Date: Mon, 8 May 2023 16:56:21 +0100
|
||||
Subject: [PATCH 2/2] cmd/go: quote entries in list-valued variables for go env
|
||||
in plan9
|
||||
|
||||
When 'go env' without an argument prints environment variables as
|
||||
a script which can be executed by the shell, variables with a
|
||||
list value in Plan 9 (such as GOPATH) need to be printed with each
|
||||
element enclosed in single quotes in case it contains characters
|
||||
significant to the Plan 9 shell (such as ' ' or '=').
|
||||
|
||||
For #58508
|
||||
|
||||
Change-Id: Ia30f51307cc6d07a7e3ada6bf9d60bf9951982ff
|
||||
Reviewed-on: https://go-review.googlesource.com/c/go/+/493535
|
||||
Run-TryBot: Cherry Mui <cherryyz@google.com>
|
||||
Reviewed-by: Cherry Mui <cherryyz@google.com>
|
||||
Reviewed-by: Russ Cox <rsc@golang.org>
|
||||
TryBot-Result: Gopher Robot <gobot@golang.org>
|
||||
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
|
||||
|
||||
CVE: CVE-2023-24531
|
||||
Upstream-Status: Backport [05cc9e55876874462a4726ca0101c970838c80e5]
|
||||
|
||||
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
|
||||
---
|
||||
src/cmd/go/internal/envcmd/env.go | 3 +--
|
||||
1 file changed, 1 insertion(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/cmd/go/internal/envcmd/env.go b/src/cmd/go/internal/envcmd/env.go
|
||||
index 0ce8843..b48d0bd 100644
|
||||
--- a/src/cmd/go/internal/envcmd/env.go
|
||||
+++ b/src/cmd/go/internal/envcmd/env.go
|
||||
@@ -397,8 +397,7 @@ func PrintEnv(w io.Writer, env []cfg.EnvVar) {
|
||||
if x > 0 {
|
||||
fmt.Fprintf(w, " ")
|
||||
}
|
||||
- // TODO(#59979): Does this need to be quoted like above?
|
||||
- fmt.Fprintf(w, "%s", s)
|
||||
+ fmt.Fprintf(w, "'%s'", strings.ReplaceAll(s, "'", "''"))
|
||||
}
|
||||
fmt.Fprintf(w, ")\n")
|
||||
}
|
||||
--
|
||||
2.35.5
|
||||
|
||||
Reference in New Issue
Block a user