commit 03ab662be894cd6eda61d00d2b6fd10bd93ecbe0 [browse]
Author: Sergey Matveev
Date: 2022-12-07 15:32:01 +03:00

Autogenerated TLS-related strings

go install golang.org/x/tools/cmd/stringer@latest
cd src/crypto/tls ; go generate

commit 97560e798cce527ee18fe1d62cbb97da225f91d1 [browse]
Author: Sergey Matveev
Date: 2020-06-19 13:26:58 +03:00

GOST X.509 and TLS 1.3 support via GoGOST

commit dc04f3ba1f25313bc9c97e728620206c235db9ee [browse]
Author: Gopher Robot
Date: 2022-12-06 19:01:35 Z

[release-branch.go1.19] go1.19.4

Change-Id: I5aced88de64f51c6f20ddf11dc8301bdf779a5e8
Reviewed-on: https://go-review.googlesource.com/c/go/+/455598
Reviewed-by: Michael Pratt <mpratt@google.com>
Run-TryBot: Gopher Robot <gobot@golang.org>
Reviewed-by: Jenny Rakoczy <jenny@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>

commit 618120c165669c00a1606505defea6ca755cdc27 [browse]
Author: Damien Neil
Date: 2022-11-30 16:46:33 -05:00

[release-branch.go1.19] net/http: update bundled golang.org/x/net/http2

Disable cmd/internal/moddeps test, since this update includes PRIVATE
track fixes.

For #56350.
For #57009.
Fixes CVE-2022-41717.

Change-Id: I5c6ce546add81f361dcf0d5123fa4eaaf8f0a03b
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663835
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/455363
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Jenny Rakoczy <jenny@golang.org>
Reviewed-by: Michael Pratt <mpratt@google.com>

commit d80340177116c079fb2ad681dd4aaa4bdc27b770 [browse]
Author: Damien Neil
Date: 2022-11-10 12:16:27 -08:00

[release-branch.go1.19] os, net/http: avoid escapes from os.DirFS and http.Dir on Windows

Do not permit access to Windows reserved device names (NUL, COM1, etc.)
via os.DirFS and http.Dir filesystems.

Avoid escapes from os.DirFS(`\`) on Windows. DirFS would join the
the root to the relative path with a path separator, making
os.DirFS(`\`).Open(`/foo/bar`) open the path `\\foo\bar`, which is
a UNC name. Not only does this not open the intended file, but permits
reference to any file on the system rather than only files on the
current drive.

Make os.DirFS("") invalid, with all file access failing. Previously,
a root of "" was interpreted as "/", which is surprising and probably
unintentional.

Fixes CVE-2022-41720
Fixes #56694

Change-Id: I275b5fa391e6ad7404309ea98ccc97405942e0f0
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663834
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/455362
Reviewed-by: Michael Pratt <mpratt@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Jenny Rakoczy <jenny@golang.org>