mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-25 07:36:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

go: Fix CVE-2026-39823

Browse Source 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] f0384f7c66
[2] https://pkg.go.dev/vuln/GO-2026-4982

(From OE-Core rev: 518085ddc368a8c247f7cc8fab3671b8b3620e30)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Hetvi Thakar
2026-08-30 23:14:47 -07:00
committed by Paul Barker
parent b24d56a0b3
commit 62881f5cca
2 changed files with 101 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/go/go-1.22.12.inc
View File

@@ -62,6 +62,7 @@ SRC_URI += "\
file://CVE-2026-25679.patch \
file://CVE-2026-32288.patch \
file://CVE-2026-27145.patch \
file://CVE-2026-39823.patch \
"
SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"

100
meta/recipes-devtools/go/go/CVE-2026-39823.patch Normal file
View File

@@ -0,0 +1,100 @@
From 4915efb53a017a136a233a7676e80858d5b6e560 Mon Sep 17 00:00:00 2001
From: Neal Patel <nealpatel@google.com>
Date: Wed, 22 Apr 2026 18:41:25 -0400
Subject: [PATCH] [release-branch.go1.25] html/template: fix escaping of URLs
in meta content attributes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The WHATWG "shared declarative refresh steps" algorithm (§4.2.5.3)
skips ASCII whitespace between "url" and "=" when parsing the URL
portion of a meta content attribute.
Thank you to Samy Ghannad for reporting this issue.
Updates #78913
Fixes #79031
Fixes CVE-2026-39823
Change-Id: I7fc3bb9394b95e07b9b10fbc95725a3de6791774
Reviewed-on: https://go-review.googlesource.com/c/go/+/769920
Reviewed-by: Roland Shoemaker <roland@golang.org>
TryBot-Bypass: Roland Shoemaker <roland@golang.org>
(cherry picked from commit f2ec1254ff32fa39f3ce4faf72bbe44eeeeebad9)
Reviewed-on: https://go-review.googlesource.com/c/go/+/772101
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
CVE: CVE-2026-39823
Upstream-Status: Backport [https://github.com/golang/go/commit/f0384f7c664892ed3ee8c0fec68638d9b3b01811]
(cherry picked from commit f0384f7c664892ed3ee8c0fec68638d9b3b01811)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
src/html/template/escape_test.go | 20 ++++++++++++++++++++
src/html/template/transition.go | 12 +++++++-----
2 files changed, 27 insertions(+), 5 deletions(-)
diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go
index ce064407384..c9e566a9076 100644
--- a/src/html/template/escape_test.go
+++ b/src/html/template/escape_test.go
@@ -759,6 +759,26 @@ func TestEscape(t *testing.T) {
`<meta http-equiv="refresh" content="{{"asd: 123"}}">`,
`<meta http-equiv="refresh" content="asd: 123">`,
},
+ {
+ "meta content url with whitespace before equals",
+ `<meta http-equiv="refresh" content="0;url ={{"javascript:alert(1)"}}">`,
+ `<meta http-equiv="refresh" content="0;url =#ZgotmplZ">`,
+ },
+ {
+ "meta content url with tab before equals",
+ "<meta http-equiv=\"refresh\" content=\"0;url\t={{\"javascript:alert(1)\"}}\">",
+ "<meta http-equiv=\"refresh\" content=\"0;url\t=#ZgotmplZ\">",
+ },
+ {
+ "meta content url with space after equals",
+ `<meta http-equiv="refresh" content="0;url= {{"javascript:alert(1)"}}">`,
+ `<meta http-equiv="refresh" content="0;url= #ZgotmplZ">`,
+ },
+ {
+ "meta content url with whitespace both sides of equals",
+ "<meta http-equiv=\"refresh\" content=\"0;url \t= {{\"javascript:alert(1)\"}}\">",
+ "<meta http-equiv=\"refresh\" content=\"0;url \t= #ZgotmplZ\">",
+ },
}
for _, test := range tests {
diff --git a/src/html/template/transition.go b/src/html/template/transition.go
index 5aa3c35440b..ac05d56b418 100644
--- a/src/html/template/transition.go
+++ b/src/html/template/transition.go
@@ -626,10 +626,12 @@ func tError(c context, s []byte) (context, int) {
// tMetaContent is the context transition function for the meta content attribute state.
func tMetaContent(c context, s []byte) (context, int) {
- for i := 0; i < len(s); i++ {
- if i+3 <= len(s)-1 && bytes.Equal(bytes.ToLower(s[i:i+4]), []byte("url=")) {
- c.state = stateMetaContentURL
- return c, i + 4
+ for i := range len(s) {
+ if i+3 <= len(s)-1 && bytes.EqualFold(s[i:i+3], []byte("url")) {
+ if j := eatWhiteSpace(s, i+3); j < len(s) && s[j] == '=' {
+ c.state = stateMetaContentURL
+ return c, j + 1
+ }
}
}
return c, len(s)
@@ -637,7 +639,7 @@ func tMetaContent(c context, s []byte) (context, int) {
// tMetaContentURL is the context transition function for the "url=" part of a meta content attribute state.
func tMetaContentURL(c context, s []byte) (context, int) {
- for i := 0; i < len(s); i++ {
+ for i := range len(s) {
if s[i] == ';' {
c.state = stateMetaContent
return c, i + 1
--
2.35.6