cmd/go/internal/pkg: fail on bad filenames

Unhidden filenames with forbidden characters in subdirectories now
correctly fail the build instead of silently being skipped.
Previously this behavior would only trigger on files in the root of
the embedded directory.

Fixes #54003
Change-Id: I52967d90d6b7929e4ae474b78d3f88732bdd3ac4
Reviewed-on: https://go-review.googlesource.com/c/go/+/670615
Reviewed-by: Michael Matloob <matloob@google.com>
Reviewed-by: Michael Matloob <matloob@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go
index 2b0eb7ca0dfcb62840f904845dacfc57feaedc1c..934a97aba1c577c06bd5dd4ae792cb0f552521c3 100644 (file)
--- a/src/cmd/go/internal/load/pkg.go
+++ b/src/cmd/go/internal/load/pkg.go
@@ -2227,12 +2227,20 @@ func resolveEmbed(pkgdir string, patterns []string) (files []string, pmap map[st
                                        rel := filepath.ToSlash(str.TrimFilePathPrefix(path, pkgdir))
                                        name := d.Name()
                                        if path != file && (isBadEmbedName(name) || ((name[0] == '.' || name[0] == '_') && !all)) {
-                                               // Ignore bad names, assuming they won't go into modules.
-                                               // Also avoid hidden files that user may not know about.
+                                               // Avoid hidden files that user may not know about.
                                                // See golang.org/issue/42328.
                                                if d.IsDir() {
                                                        return fs.SkipDir
                                                }
+                                               // Ignore hidden files.
+                                               if name[0] == '.' || name[0] == '_' {
+                                                       return nil
+                                               }
+                                               // Error on bad embed names.
+                                               // See golang.org/issue/54003.
+                                               if isBadEmbedName(name) {
+                                                       return fmt.Errorf("cannot embed file %s: invalid name %s", rel, name)
+                                               }
                                                return nil
                                        }
                                        if d.IsDir() {

diff --git a/src/cmd/go/testdata/script/embed.txt b/src/cmd/go/testdata/script/embed.txt
index 0e6bb63737e047d7a77416a6f2484ef2710469aa..dcd250549b4e2c25dd99fcee40789c8608e280d0 100644 (file)
--- a/src/cmd/go/testdata/script/embed.txt
+++ b/src/cmd/go/testdata/script/embed.txt
@@ -95,6 +95,29 @@ go build -x
 [symlink] stderr 'x.go:5:12: pattern symdir/x.txt: cannot embed file symdir[\\/]x.txt: in non-directory symdir'
 [symlink] env 'GODEBUG='
 
+# build rejects names in subdirectories with invalid punctuation
+cp x.go6 x.go
+mkdir photos/subdir
+cp x.txt photos/subdir/foo.jpg
+cp x.txt 'photos/subdir/2022-07-22T15''02''45Z.jpg'
+! go build -x
+stderr '^x.go:5:12: pattern photos/\*: cannot embed file photos/subdir/2022-07-22T15''02''45Z.jpg: invalid name 2022-07-22T15''02''45Z.jpg$'
+[!GOOS:windows] mv 'photos/subdir/2022-07-22T15''02''45Z.jpg' photos/subdir/2022-07-22T15:02:45Z.jpg
+[!GOOS:windows] ! go build -x
+[!GOOS:windows] stderr '^x.go:5:12: pattern photos/\*: cannot embed file photos/subdir/2022-07-22T15:02:45Z.jpg: invalid name 2022-07-22T15:02:45Z.jpg$'
+rm photos
+
+# build ignores hidden names in subdirectories with invalid punctuation
+cp x.go6 x.go
+mkdir photos/subdir
+[!GOOS:windows] cp x.txt photos/subdir/.2022-07-22T15:02:45Z.jpg
+[!GOOS:windows] cp x.txt photos/subdir/_2022-07-22T15:02:45Z.jpg
+cp x.txt 'photos/subdir/.2022-07-22T15''02''45Z.jpg'
+cp x.txt 'photos/subdir/_2022-07-22T15''02''45Z.jpg'
+cp x.txt photos/subdir/foo.jpg
+go build -x
+rm photos
+
 -- x.go --
 package p
 
@@ -142,6 +165,7 @@ import "embed"
 
 //go:embed symdir/*
 var X embed.FS
+
 -- x.go5 --
 package p
 
@@ -149,6 +173,15 @@ import "embed"
 
 //go:embed symdir/x.txt
 var Z string
+
+-- x.go6 --
+package p
+
+import "embed"
+
+//go:embed photos/*
+var X embed.FS
+
 -- x.txt --
 hello