From: Bryan C. Mills <bcmills@google.com>
Date: Tue, 22 Nov 2022 18:45:12 +0000 (-0500)
Subject: cmd/dist: require absolute path to executable in flattenCommandLine
X-Git-Tag: go1.21rc1~1770
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=8e0781e5ff0320d8a0cb04dded9aa0ff8f3849cd;p=gostls13.git

cmd/dist: require absolute path to executable in flattenCommandLine

This should help to prevent bugs from unintended use of system tools,
especially the system or bootstrap "go" command.
(Suggested by Austin on CL 452678.)

Updates #31567.

Change-Id: I71809ee30d06eda4b5ff8f90656d4f1a462d35dd
Reviewed-on: https://go-review.googlesource.com/c/go/+/452776
Reviewed-by: Austin Clements <austin@google.com>
Auto-Submit: Bryan Mills <bcmills@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Bryan Mills <bcmills@google.com>
---

diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
index 9ad2173daa..3182fd4e45 100644
--- a/src/cmd/dist/test.go
+++ b/src/cmd/dist/test.go
@@ -1077,6 +1077,9 @@ func flattenCmdline(cmdline []interface{}) (bin string, args []string) {
 	}
 
 	bin = list[0]
+	if !filepath.IsAbs(bin) {
+		panic("command is not absolute: " + bin)
+	}
 	return bin, list[1:]
 }
 
@@ -1300,16 +1303,24 @@ func (t *tester) registerCgoTests() {
 		default:
 			// Check for static linking support
 			var staticCheck rtPreFunc
-			cmd := t.dirCmd("misc/cgo/test",
-				compilerEnvLookup("CC", defaultcc, goos, goarch), "-xc", "-o", "/dev/null", "-static", "-")
-			cmd.Stdin = strings.NewReader("int main() {}")
-			cmd.Stdout, cmd.Stderr = nil, nil // Discard output
-			if err := cmd.Run(); err != nil {
-				// Skip these tests
+			ccName := compilerEnvLookup("CC", defaultcc, goos, goarch)
+			cc, err := exec.LookPath(ccName)
+			if err != nil {
 				staticCheck.pre = func(*distTest) bool {
-					fmt.Println("No support for static linking found (lacks libc.a?), skip cgo static linking test.")
+					fmt.Printf("$CC (%q) not found, skip cgo static linking test.\n", ccName)
 					return false
 				}
+			} else {
+				cmd := t.dirCmd("misc/cgo/test", cc, "-xc", "-o", "/dev/null", "-static", "-")
+				cmd.Stdin = strings.NewReader("int main() {}")
+				cmd.Stdout, cmd.Stderr = nil, nil // Discard output
+				if err := cmd.Run(); err != nil {
+					// Skip these tests
+					staticCheck.pre = func(*distTest) bool {
+						fmt.Println("No support for static linking found (lacks libc.a?), skip cgo static linking test.")
+						return false
+					}
+				}
 			}
 
 			// Static linking tests