os/exec: Cmd.{Run,Start} should fail if Cmd.Path is unset #52574
Labels
FrozenDueToAge
NeedsFix
The path to resolution is known, but the work has not been done.
OS-Windows
Security
Milestone
Comments
rolandshoemaker
added
OS-Windows
NeedsFix
|
Change https://go.dev/cl/403759 mentions this issue: |
|
@gopherbot please open backport issues, this is a minor security issue. |
This was referenced May 24, 2022
|
Backport issue(s) opened: #53056 (for 1.17), #53057 (for 1.18). Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases. |
|
Change https://go.dev/cl/408577 mentions this issue: |
|
Change https://go.dev/cl/408578 mentions this issue: |
gopherbot
pushed a commit
that referenced
this issue
May 27, 2022
Following up on CL 403694, there is a bit of confusion about when Path is and isn't set, along with now the exported Err field. Catch the case where Path and Err (and lookPathErr) are all unset and give a helpful error. Updates #52574 Followup after #43724. Fixes #53057 Fixes CVE-2022-30580 Change-Id: I03205172aef3801c3194f5098bdb93290c02b1b6 Reviewed-on: https://go-review.googlesource.com/c/go/+/403759 Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> (cherry picked from commit 960ffa9) Reviewed-on: https://go-review.googlesource.com/c/go/+/408577 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org>
gopherbot
pushed a commit
that referenced
this issue
May 27, 2022
Following up on CL 403694, there is a bit of confusion about when Path is and isn't set, along with now the exported Err field. Catch the case where Path and Err (and lookPathErr) are all unset and give a helpful error. Updates #52574 Followup after #43724. Fixes #53056 Fixes CVE-2022-30580 Change-Id: I03205172aef3801c3194f5098bdb93290c02b1b6 Reviewed-on: https://go-review.googlesource.com/c/go/+/403759 Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> (cherry picked from commit 960ffa9) Reviewed-on: https://go-review.googlesource.com/c/go/+/408578 Run-TryBot: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
If
Cmd.Pathis unset,Cmd.RunandCmd.Startshould throw an error.The text was updated successfully, but these errors were encountered: