Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[release/1.7 backport] switch back from golang.org/x/sys/execabs to os/exec (go1.19) #9602

Merged
merged 2 commits into from
Jan 8, 2024
Merged

[release/1.7 backport] switch back from golang.org/x/sys/execabs to os/exec (go1.19) #9602

merged 2 commits into from
Jan 8, 2024

Commits on Jan 5, 2024

  1. switch back from golang.org/x/sys/execabs to os/exec (go1.19) 

    This is effectively a revert of 2ac9968, which
switched from os/exec to the golang.org/x/sys/execabs package to mitigate
security issues (mainly on Windows) with lookups resolving to binaries in the
current directory.

from the go1.19 release notes https://go.dev/doc/go1.19#os-exec-path

> ## PATH lookups
>
> Command and LookPath no longer allow results from a PATH search to be found
> relative to the current directory. This removes a common source of security
> problems but may also break existing programs that depend on using, say,
> exec.Command("prog") to run a binary named prog (or, on Windows, prog.exe) in
> the current directory. See the os/exec package documentation for information
> about how best to update such programs.
>
> On Windows, Command and LookPath now respect the NoDefaultCurrentDirectoryInExePath
> environment variable, making it possible to disable the default implicit search
> of “.” in PATH lookups on Windows systems.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 2af6db6)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
    @thaJeztah
    thaJeztah committed Jan 5, 2024
    Configuration menu
    Copy the full SHA
    2ad2a2e View commit details
    Browse the repository at this point in the history

  2. remove remaining uses of golang.org/x/sys/execabs 

    Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
    @thaJeztah
    thaJeztah committed Jan 5, 2024
    Configuration menu
    Copy the full SHA
    872af82 View commit details
    Browse the repository at this point in the history