Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: golang/go
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: go1.21.9
Choose a base ref
...
head repository: golang/go
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: go1.21.10
Choose a head ref
  • 6 commits
  • 8 files changed
  • 5 contributors

Commits on Apr 3, 2024

  1. [release-branch.go1.21] all: tidy dependency versioning after release 

    Done with:

go get golang.org/x/net@internal-branch.go1.21-vendor
go mod tidy
go mod vendor
go generate net/http  # zero diff since CL 576075 already did this

For CVE-2023-45288.
For #65051.
For #65387.

Change-Id: I336670bdb3df2496c1e8d322c20794042fbc0d02
Reviewed-on: https://go-review.googlesource.com/c/go/+/576275
TryBot-Bypass: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Than McIntosh <thanm@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
    @dmitshur @gopherbot
    dmitshur authored and gopherbot committed Apr 3, 2024
    Copy the full SHA
    7450117 View commit details

Commits on Apr 12, 2024

  1. [release-branch.go1.21] net/http: update bundled golang.org/x/net/http2 

    Pull in CL 578336:

	ef58d90f http2: send correct LastStreamID in stream-caused GOAWAY

For #66668.
Fixes #66697.

Change-Id: I91fc8a67f21fadcb1801ff29d5e2b0453db89617
Reviewed-on: https://go-review.googlesource.com/c/go/+/578357
Reviewed-by: Carlos Amedee <carlos@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
    @dmitshur @cagedmantis
    dmitshur authored and cagedmantis committed Apr 12, 2024
    Copy the full SHA
    891ac91 View commit details

Commits on May 6, 2024

  1. [release-branch.go1.21] cmd/compile: don't combine loads in generated… 

    … equality functions

... if the architecture can't do unaligned loads.
We already handle this in a few places, but this particular place
was added in CL 399542 and missed this additional restriction.

Fixes #67164

Change-Id: I45988f11ff3ed45df1c4da3f0931ab1fdb22dbfe
Reviewed-on: https://go-review.googlesource.com/c/go/+/583175
Reviewed-by: Cuong Manh Le <cuong.manhle.vn@gmail.com>
Auto-Submit: Keith Randall <khr@google.com>
Reviewed-by: Keith Randall <khr@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Derek Parker <parkerderek86@gmail.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
(cherry picked from commit 3c72dd5)
Reviewed-on: https://go-review.googlesource.com/c/go/+/583303
    @randall77
    randall77 committed May 6, 2024
    Copy the full SHA
    58e77ad View commit details

  2. [release-branch.go1.21] Revert "cmd/compile: don't combine loads in g… 

    …enerated equality functions"

This reverts CL 583303.

Reason for revert: release branch is currently frozen.

Change-Id: Icbdb73b5b40690a875497dd0dc57ca84c728ef6f
Reviewed-on: https://go-review.googlesource.com/c/go/+/582961
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
    @cherrymui
    cherrymui committed May 6, 2024
    Copy the full SHA
    78d89b2 View commit details

Commits on May 7, 2024

  1. [release-branch.go1.21] cmd/go: disallow -lto_library in LDFLAGS 

    The darwin linker allows setting the LTO library with the -lto_library
flag. This wasn't caught by our "safe linker flags" check because it
was covered by the -lx flag used for linking libraries. This change
adds a specific check for excluded flags which otherwise satisfy our
existing checks.

Loading a mallicious LTO library would allow an attacker to cause the
linker to execute abritrary code when "go build" was called.

Thanks to Juho Forsén of Mattermost for reporting this issue.

Fixes #67119
Fixes #67121
Fixes CVE-2024-24787

Change-Id: I77ac8585efbdbdfd5f39c39ed623b9408a0f9eaf
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1380
Reviewed-by: Russ Cox <rsc@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
(cherry picked from commit 9a79141fbbca1105e5c786f15e38741ca7843290)
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1401
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/583795
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
    @rolandshoemaker @cherrymui
    rolandshoemaker authored and cherrymui committed May 7, 2024
    Copy the full SHA
    a79ea27 View commit details

  2. [release-branch.go1.21] go1.21.10 

    Change-Id: I655ab537d86a2ec71634a2f4ca5d520834de9fda
Reviewed-on: https://go-review.googlesource.com/c/go/+/583857
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
    @gopherbot @cherrymui
    gopherbot authored and cherrymui committed May 7, 2024
    Copy the full SHA
    752b009 View commit details
4 changes: 2 additions & 2 deletions VERSION
View file
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
go1.21.9
time 2024-03-29T15:27:02Z
go1.21.10
time 2024-05-01T19:49:47Z
19 changes: 15 additions & 4 deletions src/cmd/go/internal/work/security.go
View file
Original file line number Diff line number Diff line change
@@ -141,6 +141,12 @@ var validCompilerFlagsWithNextArg = []string{
"-x",
}

var invalidLinkerFlags = []*lazyregexp.Regexp{
// On macOS this means the linker loads and executes the next argument.
// Have to exclude separately because -lfoo is allowed in general.
re(`-lto_library`),
}

var validLinkerFlags = []*lazyregexp.Regexp{
re(`-F([^@\-].*)`),
re(`-l([^@\-].*)`),
@@ -231,12 +237,12 @@ var validLinkerFlagsWithNextArg = []string{

func checkCompilerFlags(name, source string, list []string) error {
checkOverrides := true
return checkFlags(name, source, list, validCompilerFlags, validCompilerFlagsWithNextArg, checkOverrides)
return checkFlags(name, source, list, nil, validCompilerFlags, validCompilerFlagsWithNextArg, checkOverrides)
}

func checkLinkerFlags(name, source string, list []string) error {
checkOverrides := true
return checkFlags(name, source, list, validLinkerFlags, validLinkerFlagsWithNextArg, checkOverrides)
return checkFlags(name, source, list, invalidLinkerFlags, validLinkerFlags, validLinkerFlagsWithNextArg, checkOverrides)
}

// checkCompilerFlagsForInternalLink returns an error if 'list'
@@ -245,7 +251,7 @@ func checkLinkerFlags(name, source string, list []string) error {
// external linker).
func checkCompilerFlagsForInternalLink(name, source string, list []string) error {
checkOverrides := false
if err := checkFlags(name, source, list, validCompilerFlags, validCompilerFlagsWithNextArg, checkOverrides); err != nil {
if err := checkFlags(name, source, list, nil, validCompilerFlags, validCompilerFlagsWithNextArg, checkOverrides); err != nil {
return err
}
// Currently the only flag on the allow list that causes problems
@@ -258,7 +264,7 @@ func checkCompilerFlagsForInternalLink(name, source string, list []string) error
return nil
}

func checkFlags(name, source string, list []string, valid []*lazyregexp.Regexp, validNext []string, checkOverrides bool) error {
func checkFlags(name, source string, list []string, invalid, valid []*lazyregexp.Regexp, validNext []string, checkOverrides bool) error {
// Let users override rules with $CGO_CFLAGS_ALLOW, $CGO_CFLAGS_DISALLOW, etc.
var (
allow *regexp.Regexp
@@ -290,6 +296,11 @@ Args:
if allow != nil && allow.FindString(arg) == arg {
continue Args
}
for _, re := range invalid {
if re.FindString(arg) == arg { // must be complete match
goto Bad
}
}
for _, re := range valid {
if re.FindString(arg) == arg { // must be complete match
continue Args
17 changes: 17 additions & 0 deletions src/cmd/go/testdata/script/darwin_lto_library_ldflag.txt
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
[!GOOS:darwin] skip
[!cgo] skip

! go build
stderr 'invalid flag in #cgo LDFLAGS: -lto_library'

-- go.mod --
module ldflag

-- main.go --
package main

// #cgo CFLAGS: -flto
// #cgo LDFLAGS: -lto_library bad.dylib
import "C"

func main() {}
2 changes: 0 additions & 2 deletions src/cmd/internal/moddeps/moddeps_test.go
View file
Original file line number Diff line number Diff line change
@@ -33,8 +33,6 @@ import (
// See issues 36852, 41409, and 43687.
// (Also see golang.org/issue/27348.)
func TestAllDependencies(t *testing.T) {
t.Skip("TODO(#65051): 1.21.9 contains unreleased changes from vendored modules")

goBin := testenv.GoToolPath(t)

// Ensure that all packages imported within GOROOT
2 changes: 1 addition & 1 deletion src/go.mod
View file
Original file line number Diff line number Diff line change
@@ -4,7 +4,7 @@ go 1.21

require (
golang.org/x/crypto v0.11.1-0.20230711161743-2e82bdd1719d
golang.org/x/net v0.12.1-0.20240327214420-1a2eef3ba536
golang.org/x/net v0.12.1-0.20240412193743-ef58d90fdfc5
)

require (
4 changes: 2 additions & 2 deletions src/go.sum
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
golang.org/x/crypto v0.11.1-0.20230711161743-2e82bdd1719d h1:LiA25/KWKuXfIq5pMIBq1s5hz3HQxhJJSu/SUGlD+SM=
golang.org/x/crypto v0.11.1-0.20230711161743-2e82bdd1719d/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
golang.org/x/net v0.12.1-0.20240327214420-1a2eef3ba536 h1:QEPT0Le4+itOUqHbs7yUz5y7FoAOuK1ibDlfTcVguHM=
golang.org/x/net v0.12.1-0.20240327214420-1a2eef3ba536/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
golang.org/x/net v0.12.1-0.20240412193743-ef58d90fdfc5 h1:BIx9jz/hjPE1CesqfHzRaf2JsOjDxZrKAVr//XXJh0U=
golang.org/x/net v0.12.1-0.20240412193743-ef58d90fdfc5/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
22 changes: 15 additions & 7 deletions src/net/http/h2_bundle.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion src/vendor/modules.txt
View file
Original file line number Diff line number Diff line change
@@ -7,7 +7,7 @@ golang.org/x/crypto/cryptobyte/asn1
golang.org/x/crypto/hkdf
golang.org/x/crypto/internal/alias
golang.org/x/crypto/internal/poly1305
# golang.org/x/net v0.12.1-0.20240327214420-1a2eef3ba536
# golang.org/x/net v0.12.1-0.20240412193743-ef58d90fdfc5
## explicit; go 1.17
golang.org/x/net/dns/dnsmessage
golang.org/x/net/http/httpguts