Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

switch back from golang.org/x/sys/execabs to os/exec (go1.19) #317

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

thaJeztah
Copy link
Contributor

This reverts commit f2a5645, which switched from os/exec to the golang.org/x/sys/execabs package to mitigate security issues (mainly on Windows) with lookups resolving to binaries in the current directory.

from the go1.19 release notes https://go.dev/doc/go1.19#os-exec-path

PATH lookups

Command and LookPath no longer allow results from a PATH search to be found
relative to the current directory. This removes a common source of security
problems but may also break existing programs that depend on using, say,
exec.Command("prog") to run a binary named prog (or, on Windows, prog.exe) in
the current directory. See the os/exec package documentation for information
about how best to update such programs.

On Windows, Command and LookPath now respect the NoDefaultCurrentDirectoryInExePath
environment variable, making it possible to disable the default implicit search
of “.” in PATH lookups on Windows systems.

This reverts commit f2a5645, which switched
from os/exec to the golang.org/x/sys/execabs package to mitigate security
issues (mainly on Windows) with lookups resolving to binaries in the current
directory.

from the go1.19 release notes https://go.dev/doc/go1.19#os-exec-path

> ## PATH lookups
>
> Command and LookPath no longer allow results from a PATH search to be found
> relative to the current directory. This removes a common source of security
> problems but may also break existing programs that depend on using, say,
> exec.Command("prog") to run a binary named prog (or, on Windows, prog.exe) in
> the current directory. See the os/exec package documentation for information
> about how best to update such programs.
>
> On Windows, Command and LookPath now respect the NoDefaultCurrentDirectoryInExePath
> environment variable, making it possible to disable the default implicit search
> of “.” in PATH lookups on Windows systems.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah thaJeztah requested a review from a team as a code owner April 22, 2024 18:37
@thaJeztah
Copy link
Contributor Author

cc @kevpar @helsaawy (I noticed that using the latest go-winio with current versions of go.. brought back this package as a dependency)

@thaJeztah
Copy link
Contributor Author

oh! looks like it's coming back through golang.org/x/tools (v0.11.0 still uses it, as it's missing golang/tools@f60f2e6). In either case, it should be good to remove it as import 😅

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants