Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cmd/go: toolchain directive can point to file relative to go.mod with ADS on windows #71470

Open
rolandshoemaker opened this issue Jan 28, 2025 · 0 comments
Open

cmd/go: toolchain directive can point to file relative to go.mod with ADS on windows #71470

rolandshoemaker opened this issue Jan 28, 2025 · 0 comments
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. OS-Windows Security

Comments

@rolandshoemaker
Copy link
Member

Due to #71469, a toolchain directive with a ADS suffix (e.g. toolchain go1.25-:alt), can result in the toolchain attempting to execute a files alternate data stream that is located alongside the go.mod file.

Since it's somewhat complex to create a file with ADS, and as far as we could tell no source control software supports it, while clearly unexpected, we do not consider this significantly dangerous.

This is a PUBLIC track security issue per our security policy.

Thanks to Juho Forsén for reporting this issue.
@cagedmantis cagedmantis added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jan 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. OS-Windows Security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@cagedmantis @rolandshoemaker