src/cmd/go/internal/get/path.go | 21 ++++++++++++++++++++- diff --git a/src/cmd/go/internal/get/path.go b/src/cmd/go/internal/get/path.go index 2920fc2085106efa2c59ebf4038445037f9a1992..c8072b25fd4c40b94cd36563a8feb3d049db75d0 100644 --- a/src/cmd/go/internal/get/path.go +++ b/src/cmd/go/internal/get/path.go @@ -11,7 +11,8 @@ "unicode" "unicode/utf8" ) -// The following functions are copied verbatim from cmd/go/internal/module/module.go. +// The following functions are copied verbatim from cmd/go/internal/module/module.go, +// with one change to additionally reject Windows short-names. // // TODO(bcmills): After the call site for this function is backported, // consolidate this back down to a single copy. @@ -76,6 +77,7 @@ } if elem[len(elem)-1] == '.' { return fmt.Errorf("trailing dot in path element") } + charOK := pathOK if fileName { charOK = fileNameOK @@ -97,6 +99,23 @@ if strings.EqualFold(bad, short) { return fmt.Errorf("disallowed path element %q", elem) } } + + // Reject path components that look like Windows short-names. + // Those usually end in a tilde followed by one or more ASCII digits. + if tilde := strings.LastIndexByte(short, '~'); tilde >= 0 && tilde < len(short)-1 { + suffix := short[tilde+1:] + suffixIsDigits := true + for _, r := range suffix { + if r < '0' || r > '9' { + suffixIsDigits = false + break + } + } + if suffixIsDigits { + return fmt.Errorf("trailing tilde and digits in path element") + } + } + return nil }