cmd/dist: require absolute path to executable in flattenCommandLine

This should help to prevent bugs from unintended use of system tools,
especially the system or bootstrap "go" command.
(Suggested by Austin on CL 452678.)

Updates #31567.

Change-Id: I71809ee30d06eda4b5ff8f90656d4f1a462d35dd
Reviewed-on: https://go-review.googlesource.com/c/go/+/452776
Reviewed-by: Austin Clements <austin@google.com>
Auto-Submit: Bryan Mills <bcmills@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Bryan Mills <bcmills@google.com>

diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
index 9ad2173daa3ccbab5c4c4924f93a7ba99b197d7b..3182fd4e455003e6c348ce4c5da373ae60287b5f 100644 (file)
--- a/src/cmd/dist/test.go
+++ b/src/cmd/dist/test.go
@@ -1077,6 +1077,9 @@ func flattenCmdline(cmdline []interface{}) (bin string, args []string) {
        }
 
        bin = list[0]
+       if !filepath.IsAbs(bin) {
+               panic("command is not absolute: " + bin)
+       }
        return bin, list[1:]
 }
 
@@ -1300,16 +1303,24 @@ func (t *tester) registerCgoTests() {
                default:
                        // Check for static linking support
                        var staticCheck rtPreFunc
-                       cmd := t.dirCmd("misc/cgo/test",
-                               compilerEnvLookup("CC", defaultcc, goos, goarch), "-xc", "-o", "/dev/null", "-static", "-")
-                       cmd.Stdin = strings.NewReader("int main() {}")
-                       cmd.Stdout, cmd.Stderr = nil, nil // Discard output
-                       if err := cmd.Run(); err != nil {
-                               // Skip these tests
+                       ccName := compilerEnvLookup("CC", defaultcc, goos, goarch)
+                       cc, err := exec.LookPath(ccName)
+                       if err != nil {
                                staticCheck.pre = func(*distTest) bool {
-                                       fmt.Println("No support for static linking found (lacks libc.a?), skip cgo static linking test.")
+                                       fmt.Printf("$CC (%q) not found, skip cgo static linking test.\n", ccName)
                                        return false
                                }
+                       } else {
+                               cmd := t.dirCmd("misc/cgo/test", cc, "-xc", "-o", "/dev/null", "-static", "-")
+                               cmd.Stdin = strings.NewReader("int main() {}")
+                               cmd.Stdout, cmd.Stderr = nil, nil // Discard output
+                               if err := cmd.Run(); err != nil {
+                                       // Skip these tests
+                                       staticCheck.pre = func(*distTest) bool {
+                                               fmt.Println("No support for static linking found (lacks libc.a?), skip cgo static linking test.")
+                                               return false
+                                       }
+                               }
                        }
 
                        // Static linking tests