Skip to content

Commit 28fbdf7

Browse files
rolandshoemakergopherbot
rolandshoemaker
authored and
gopherbot
committed
cmd/go: fix pkg-config flag sanitization
Implement a new pkg-config safe flag list (containing everything except for --log-file) and use that when checking flags passed to pkg-config, instead of using checkCompilerFlags. Fixes #77387 Change-Id: Id6141d0a2934053aa43e3aa8ce402bd499c4c028 Reviewed-on: https://go-review.googlesource.com/c/go/+/741042 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Michael Pratt <[email protected]> Auto-Submit: Roland Shoemaker <[email protected]> Reviewed-by: Ian Lance Taylor <[email protected]>
1 parent 045d127 commit 28fbdf7

3 files changed

Lines changed: 67 additions & 4 deletions

File tree

‎src/cmd/go/internal/work/exec.go‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1797,10 +1797,7 @@ func (b *Builder) getPkgConfigFlags(a *Action, p *load.Package) (cflags, ldflags
17971797
}
17981798
}
17991799

1800-
// Running 'pkg-config' can cause execution of
1801-
// arbitrary code using flags that are not in
1802-
// the safelist.
1803-
if err := checkCompilerFlags("CFLAGS", "pkg-config --cflags", pcflags); err != nil {
1800+
if err := checkPkgConfigFlags("", "pkg-config", pcflags); err != nil {
18041801
return nil, nil, err
18051802
}
18061803

‎src/cmd/go/internal/work/security.go‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,58 @@ var validLinkerFlagsWithNextArg = []string{
253253
"-Wl,-undefined",
254254
}
255255

256+
var validPkgConfigFlags = []*lazyregexp.Regexp{
257+
re(`--atleast-pkgconfig-version=\d+\.\d+\.\d+`),
258+
re(`--atleast-version=\d+\.\d+\.\d+`),
259+
re(`--cflags-only-I`),
260+
re(`--cflags`),
261+
re(`--define-prefix`),
262+
re(`--define-variable=[A-Za-z_][A-Za-z0-9_]*=[^@\-]*`),
263+
re(`--digraph`),
264+
re(`--dont-define-prefix`),
265+
re(`--dont-relocate-paths`),
266+
re(`--dump-personality`),
267+
re(`--env-only`),
268+
re(`--errors-to-stdout`),
269+
re(`--exact-version=\d+\.\d+\.\d+`),
270+
re(`--exists`),
271+
re(`--fragment-filter=[A-Za-z_][a-zA-Z0-9_]*`),
272+
re(`--ignore-conflicts`),
273+
re(`--internal-cflags`),
274+
re(`--keep-system-cflags`),
275+
re(`--keep-system-libs`),
276+
re(`--libs-only-l`),
277+
re(`--libs-only-L`),
278+
re(`--libs`),
279+
re(`--list-all`),
280+
re(`--list-package-names`),
281+
re(`--max-version=\d+\.\d+\.\d+`),
282+
re(`--maximum-traverse-depth=[0-9]+`),
283+
re(`--modversion`),
284+
re(`--msvc-syntax`),
285+
re(`--no-cache`),
286+
re(`--no-provides`),
287+
re(`--no-uninstalled`),
288+
re(`--path`),
289+
re(`--personality=(triplet|filename)`),
290+
re(`--prefix-variable=[A-Za-z_][a-zA-Z0-9_]*`),
291+
re(`--print-errors`),
292+
re(`--print-provides`),
293+
re(`--print-requires-private`),
294+
re(`--print-requires`),
295+
re(`--print-variables`),
296+
re(`--pure`),
297+
re(`--shared`),
298+
re(`--short-errors`),
299+
re(`--silence-errors`),
300+
re(`--simulate`),
301+
re(`--static`),
302+
re(`--uninstalled`),
303+
re(`--validate`),
304+
re(`--variable=[A-Za-z_][a-zA-Z0-9_]*`),
305+
re(`--with-path=[^@\-].*`),
306+
}
307+
256308
func checkCompilerFlags(name, source string, list []string) error {
257309
checkOverrides := true
258310
return checkFlags(name, source, list, nil, validCompilerFlags, validCompilerFlagsWithNextArg, checkOverrides)
@@ -263,6 +315,11 @@ func checkLinkerFlags(name, source string, list []string) error {
263315
return checkFlags(name, source, list, invalidLinkerFlags, validLinkerFlags, validLinkerFlagsWithNextArg, checkOverrides)
264316
}
265317

318+
func checkPkgConfigFlags(name, source string, list []string) error {
319+
checkOverrides := false
320+
return checkFlags(name, source, list, nil, validPkgConfigFlags, nil, checkOverrides)
321+
}
322+
266323
// checkCompilerFlagsForInternalLink returns an error if 'list'
267324
// contains a flag or flags that may not be fully supported by
268325
// internal linking (meaning that we should punt the link to the

‎src/cmd/go/testdata/script/cgo_bad_directives.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@ cp y_pkgconfig_at_foo.txt y.go
4545
! go build x
4646
stderr 'invalid pkg-config package name: @foo'
4747

48+
# Reject #cgo pkg-config: --log-file=/tmp/log
49+
cp y_pkgconfig_log_file.txt y.go
50+
! go build x
51+
stderr 'invalid flag in pkg-config: --log-file=/tmp/log'
52+
4853
# Reject #cgo CFLAGS: @foo
4954
cp y_cflags_at_foo.txt y.go
5055
! go build x
@@ -108,6 +113,10 @@ import "C"
108113
package x
109114
// #cgo pkg-config: @foo
110115
import "C"
116+
-- y_pkgconfig_log_file.txt --
117+
package x
118+
// #cgo pkg-config: --log-file=/tmp/log
119+
import "C"
111120
-- y_cflags_at_foo.txt --
112121
package x
113122
// #cgo CFLAGS: @foo

0 commit comments

Comments
 (0)