mirror of
https://github.com/golang/go.git
synced 2026-02-05 18:35:03 +03:00
cmd/go: remove user-content from doc strings in cgo ASTs.
Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue. Updates golang/go#76697 Fixes CVE-2025-61732 Change-Id: I1121502f1bf1e91309eb4bd41cc3a09c39366d36 Reviewed-on: https://go-review.googlesource.com/c/go/+/734220 Reviewed-by: Agustin Hernandez <garisol1982@gmail.com> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Robert Griesemer <gri@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
This commit is contained in:
@@ -301,17 +301,12 @@ func (f *File) saveExport(x any, context astContext) {
|
||||
error_(c.Pos(), "export comment has wrong name %q, want %q", name, n.Name.Name)
|
||||
}
|
||||
|
||||
doc := ""
|
||||
for _, c1 := range n.Doc.List {
|
||||
if c1 != c {
|
||||
doc += c1.Text + "\n"
|
||||
}
|
||||
}
|
||||
|
||||
f.ExpFunc = append(f.ExpFunc, &ExpFunc{
|
||||
Func: n,
|
||||
ExpName: name,
|
||||
Doc: doc,
|
||||
// Caution: Do not set the Doc field on purpose
|
||||
// to ensure that there are no unintended artifacts
|
||||
// in the binary. See https://go.dev/issue/76697.
|
||||
})
|
||||
break
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user