Explorar el Código

builder/remotecontext/gitutils: switch back to os/exec

This is a partial revert of 7ca0cb7ffafc5339ac5fa575ce3f8b479c3643bf, which
switched from os/exec to the golang.org/x/sys/execabs package to mitigate
security issues (mainly on Windows) with lookups resolving to binaries in the
current directory.

from the go1.19 release notes https://go.dev/doc/go1.19#os-exec-path

> ## PATH lookups
>
> Command and LookPath no longer allow results from a PATH search to be found
> relative to the current directory. This removes a common source of security
> problems but may also break existing programs that depend on using, say,
> exec.Command("prog") to run a binary named prog (or, on Windows, prog.exe) in
> the current directory. See the os/exec package documentation for information
> about how best to update such programs.
>
> On Windows, Command and LookPath now respect the NoDefaultCurrentDirectoryInExePath
> environment variable, making it possible to disable the default implicit search
> of “.” in PATH lookups on Windows systems.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sebastiaan van Stijn hace 2 años
padre
commit
b7d242f094
Se han modificado 1 ficheros con 1 adiciones y 1 borrados
  1. 1 1
      builder/remotecontext/git/gitutils.go

+ 1 - 1
builder/remotecontext/git/gitutils.go

@@ -4,12 +4,12 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 
 	"github.com/moby/sys/symlink"
 	"github.com/pkg/errors"
-	exec "golang.org/x/sys/execabs"
 )
 
 type gitRepo struct {