cmd/go: check pattern for utf8 validity before call regexp.MustCompile

Do not panic if the package path or the package version contains
invalid UTF-8 characters.

Fixes #75251

Change-Id: Ib787e74277cf814253857b911d378ea5e53d8824
Reviewed-on: https://go-review.googlesource.com/c/go/+/700815
Reviewed-by: Michael Matloob <matloob@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ian Alexander <jitsu@google.com>
Reviewed-by: Michael Matloob <matloob@golang.org>

diff --git a/src/cmd/go/internal/modget/query.go b/src/cmd/go/internal/modget/query.go
index f95b503d8f60346c3ef5e7e45f42f699710744b1..05872d52ec4e0476f01da17efb6cf9d77c773d13 100644 (file)
--- a/src/cmd/go/internal/modget/query.go
+++ b/src/cmd/go/internal/modget/query.go
@@ -10,6 +10,7 @@ import (
        "regexp"
        "strings"
        "sync"
+       "unicode/utf8"
 
        "cmd/go/internal/base"
        "cmd/go/internal/gover"
@@ -285,6 +286,11 @@ func reportError(q *query, err error) {
        // TODO(bcmills): Use errors.As to unpack these errors instead of parsing
        // strings with regular expressions.
 
+       if !utf8.ValidString(q.pattern) || !utf8.ValidString(q.version) {
+               base.Errorf("go: %s", errStr)
+               return
+       }
+
        patternRE := regexp.MustCompile("(?m)(?:[ \t(\"`]|^)" + regexp.QuoteMeta(q.pattern) + "(?:[ @:;)\"`]|$)")
        if patternRE.MatchString(errStr) {
                if q.rawVersion == "" {

diff --git a/src/cmd/go/testdata/script/get_panic_issue75251.txt b/src/cmd/go/testdata/script/get_panic_issue75251.txt
new file mode 100644 (file)
index 0000000..2cc3f3a
--- /dev/null
+++ b/src/cmd/go/testdata/script/get_panic_issue75251.txt
@@ -0,0 +1,16 @@
+# Issue #75251: Don't panic if the package path or the package version
+# contains invalid UTF-8 characters.
+
+go mod init m
+
+! go get golang.org/x/net/http/httpgutsÿv0.43.0 # contains 0xff byte
+! stderr panic
+stderr 'malformed module path'
+
+! go get golang.org/x/net/http/httpgutsÿ@v0.43.0 # contains 0xff byte
+! stderr panic
+stderr 'malformed module path'
+
+! go get golang.org/x/net/http/httpguts@ÿv0.43.0 # contains 0xff byte
+! stderr panic
+stderr 'disallowed version string'

diff --git a/src/cmd/internal/pkgpattern/pkgpattern.go b/src/cmd/internal/pkgpattern/pkgpattern.go
index 1496eebb3e4d9d13a3dee4db1944b66f42e4043d..5bbe8a52fb1075397d818c74b8a97785c503d008 100644 (file)
--- a/src/cmd/internal/pkgpattern/pkgpattern.go
+++ b/src/cmd/internal/pkgpattern/pkgpattern.go
@@ -7,6 +7,7 @@ package pkgpattern
 import (
        "regexp"
        "strings"
+       "unicode/utf8"
 )
 
 // Note: most of this code was originally part of the cmd/go/internal/search
@@ -71,7 +72,7 @@ func matchPatternInternal(pattern string, vendorExclude bool) func(name string)
 
        const vendorChar = "\x00"
 
-       if vendorExclude && strings.Contains(pattern, vendorChar) {
+       if vendorExclude && strings.Contains(pattern, vendorChar) || !utf8.ValidString(pattern) {
                return func(name string) bool { return false }
        }