[release-branch.go1.18] os/exec: return clear error for missing cmd.Path

Following up on CL 403694, there is a bit of confusion about
when Path is and isn't set, along with now the exported Err field.
Catch the case where Path and Err (and lookPathErr) are all unset
and give a helpful error.

Updates #52574
Followup after #43724.

Fixes #53057
Fixes CVE-2022-30580

Change-Id: I03205172aef3801c3194f5098bdb93290c02b1b6
Reviewed-on: https://go-review.googlesource.com/c/go/+/403759
Reviewed-by: Bryan Mills <bcmills@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
(cherry picked from commit 960ffa98ce73ef2c2060c84c7ac28d37a83f345e)
Reviewed-on: https://go-review.googlesource.com/c/go/+/408577
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>

diff --git a/src/os/exec/exec.go b/src/os/exec/exec.go
index 845b737e28fc773538b8c9701b44162245eda300..ecddee690de7c83a84d968bd8113131f274d9400 100644 (file)
--- a/src/os/exec/exec.go
+++ b/src/os/exec/exec.go
@@ -374,6 +374,9 @@ func lookExtensions(path, dir string) (string, error) {
 // The Wait method will return the exit code and release associated resources
 // once the command exits.
 func (c *Cmd) Start() error {
+       if c.Path == "" && c.lookPathErr == nil {
+               c.lookPathErr = errors.New("exec: no command")
+       }
        if c.lookPathErr != nil {
                c.closeDescriptors(c.closeAfterStart)
                c.closeDescriptors(c.closeAfterWait)

diff --git a/src/os/exec/exec_test.go b/src/os/exec/exec_test.go
index 73aa35f1aed1fce2dd0b002a039632043c660350..1913ae81c8976f1eaa92a2cd81126421847736e7 100644 (file)
--- a/src/os/exec/exec_test.go
+++ b/src/os/exec/exec_test.go
@@ -1081,3 +1081,11 @@ func TestChildCriticalEnv(t *testing.T) {
                t.Error("no SYSTEMROOT found")
        }
 }
+
+func TestNoPath(t *testing.T) {
+       err := new(exec.Cmd).Start()
+       want := "exec: no command"
+       if err == nil || err.Error() != want {
+               t.Errorf("new(Cmd).Start() = %v, want %q", err, want)
+       }
+}