[release-branch.go1.19] cmd/cover: error out if a requested source file contains...

cmd/cover uses '//line' directives to map instrumented source files
back to the original source file and line numbers.
Line directives have no way to escape newline characters, so cmd/cover
must not be used with source file paths that contain such characters.

Updates #60515.
Updates #60167.

Change-Id: I6dc039392d59fc3a5a6121ef6ca97b0ab0da5288
Reviewed-on: https://go-review.googlesource.com/c/go/+/501577
Auto-Submit: Bryan Mills <bcmills@google.com>
Run-TryBot: Bryan Mills <bcmills@google.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
(cherry picked from commit 3d78c735fc7d213e23383b9744297bd5251dc0e3)
Reviewed-on: https://go-review.googlesource.com/c/go/+/501822

diff --git a/src/cmd/cover/cover.go b/src/cmd/cover/cover.go
index 86ef128f2cccb17818af39b0fe3f4b403bae4a32..d8c4f857086715047e91edafc2a87edaa5829372 100644 (file)
--- a/src/cmd/cover/cover.go
+++ b/src/cmd/cover/cover.go
@@ -15,6 +15,7 @@ import (
        "log"
        "os"
        "sort"
+       "strings"
 
        "cmd/internal/edit"
        "cmd/internal/objabi"
@@ -341,6 +342,9 @@ func annotate(name string) {
                }
        }
 
+       if strings.ContainsAny(name, "\r\n") {
+               log.Fatalf("cover: input path contains newline character: %q", name)
+       }
        fmt.Fprintf(fd, "//line %s:1\n", name)
        fd.Write(newContent)
 

diff --git a/src/cmd/cover/cover_test.go b/src/cmd/cover/cover_test.go
index 28be23112171076358ecef4a19de355b1be399ce..8a68911bd32f1b3e789bbdeb9de6a1bf1ad6e71e 100644 (file)
--- a/src/cmd/cover/cover_test.go
+++ b/src/cmd/cover/cover_test.go
@@ -570,3 +570,34 @@ func run(c *exec.Cmd, t *testing.T) {
                t.Fatal(err)
        }
 }
+
+func TestSrcPathWithNewline(t *testing.T) {
+       t.Parallel()
+       buildCover(t)
+
+       // srcPath is intentionally not clean so that the path passed to testcover
+       // will not normalize the trailing / to a \ on Windows.
+       srcPath := t.TempDir() + string(filepath.Separator) + "\npackage main\nfunc main() { panic(string([]rune{'u', 'h', '-', 'o', 'h'}))\n/*/main.go"
+       mainSrc := ` package main
+
+func main() {
+       /* nothing here */
+       println("ok")
+}
+`
+       if err := os.MkdirAll(filepath.Dir(srcPath), 0777); err != nil {
+               t.Skipf("creating directory with bogus path: %v", err)
+       }
+       if err := os.WriteFile(srcPath, []byte(mainSrc), 0666); err != nil {
+               t.Skipf("writing file with bogus directory: %v", err)
+       }
+
+       cmd := exec.Command(testcover, "-mode=atomic", srcPath)
+       cmd.Stderr = new(bytes.Buffer)
+       out, err := cmd.Output()
+       t.Logf("%v:\n%s", cmd, out)
+       t.Logf("stderr:\n%s", cmd.Stderr)
+       if err == nil {
+               t.Errorf("unexpected success; want failure due to newline in file path")
+       }
+}