commit c19862e5f8415b4f24b189d065ed739517c548ba [browse]
Author: Gopher Robot
Date: 2026-07-07 12:21:32 -07:00
[release-branch.go1.26] go1.26.5
Change-Id: I87dc3d84cde11db83a0d88a60262a38fc429838d
Reviewed-on: https://go-review.googlesource.com/c/go/+/797740
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Junyang Shao <shaojunyang@google.com>
TryBot-Bypass: Gopher Robot <gobot@golang.org>
commit f9ef7f55988f03afeb3b8354367d0fa8d053683d [browse]
Author: Damien Neil
Date: 2026-05-26 13:59:05 -07:00
[release-branch.go1.26] os: properly handle trailing slashes in paths in Root
This change fixes a significant mechanism by which
operations in a Root can escape the root.
The implementation of Root on platforms supporting the openat
family of functions assumed that openat(parent, "f/", O_NOFOLLOW)
would not resolve symlinks in "f". This is not correct; the
trailing slash causes f to be resolved.
This permits Root operations to escape when the target filename
ends in a slash and the target is a symlink to a directory outside the
root. This does not permit directly accessing non-directory files
outside a root, since the trailing slash adds a requirement that the
target be a directory. However, under some circumstances an attacker
might exploit this flaw to access non-directory files outside
a root, for example by first renaming a directory outside the root
to a location within it and then accessing files within that directory.
This change adjusts Root's handling of slash-terminated paths.
Trailing slashes are removed from the path at the start of an
operation, and the presence of slashes is tracked as a boolean.
Slashes are never reattached to a path component.
In addition, the doInRoot helper function now automatically
handles trailing slashes in a POSIX-compatible fashion.
When a path ends in one or more slashes:
- symlinks in the final component are resolved; and
- the final path component after symlink resolutions
must reference a directory.
This change also adds a new sets of tests to exercise Root's
behavior in a wider variety of circumstances. These tests
run through a matrix of file configurations, such as:
- path "target", a regular file
- path "dir/../target", a directory
- path "target/", a symlink to "dir/../target/", which does not exist
- etc.
These tests execute Root operations and the corresponding unrooted
operation, validate specific expected results for some configurations,
and verify that the rooted and unrooted versions of the operation
produce the same result.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
Fixes #79005
Fixes CVE-2026-39822
Change-Id: I34072ab63f2367baf236592f11143f4e6a6a6964
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/4740
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/4840
Reviewed-on: https://go-review.googlesource.com/c/go/+/797661
Reviewed-by: Junyang Shao <shaojunyang@google.com>
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Reviewed-by: David Chase <drchase@google.com>
commit ca8ca590ccfda1e1c3186faf975afdb02cb6d2f0 [browse]
Author: Roland Shoemaker
Date: 2026-05-08 09:22:41 -07:00
[release-branch.go1.26] crypto/tls: omit PSK in ECH outer client hello
When using ECH, do not include the PSK extension in the outer hello.
Including the PSK extension allows for a degradation in privacy, as an
on-path attacker can harvest outer client hellos, and then construct new
hellos using the PSK extension and arbitrary guessed SNI values,
replaying them to the target server. If the server rejects the PSK, the
handshake will continue, but if the PSK is accepted, the binder check
will fail.
Thanks to Coia Prant (github.com/rbqvq) for
reporting this issue.
Fixes CVE-2026-42505
Updates #79282
Fixes #80175
Change-Id: Ib3a3c948106a57c1b07b9e61a58cbf757848be18
Reviewed-on: https://go-review.googlesource.com/c/go/+/775960
Auto-Submit: Roland Shoemaker <roland@golang.org>
TryBot-Bypass: Roland Shoemaker <roland@golang.org>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
Reviewed-by: Carlos Amedee <carlos@golang.org>
(cherry picked from commit 137b8065ab5b485bbde0ed430dd89841c0602bb2)
Reviewed-on: https://go-review.googlesource.com/c/go/+/794921
TryBot-Bypass: Junyang Shao <shaojunyang@google.com>
Reviewed-by: Junyang Shao <shaojunyang@google.com>
Commit-Queue: Roland Shoemaker <roland@golang.org>
Auto-Submit: Junyang Shao <shaojunyang@google.com>
Commit-Queue: Junyang Shao <shaojunyang@google.com>
commit 7397dd7495724542484dbd0d9ad09c35f7ccd003 [browse]
Author: Nicholas S. Husin
Date: 2026-06-30 16:18:33 -04:00
[release-branch.go1.26] net: fix TestLookupCNAME
The CNAME record for www.iana.org seems to have been changed, causing
test failures.
Change the test to just use www.golang.org, so we have more control and
awareness of such changes in the future.
For #80212
Fixes #80217
Change-Id: I7b11bb8f90fe366db019dab1f8d9a1cf6a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/795841
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-by: Junyang Shao <shaojunyang@google.com>
Auto-Submit: Junyang Shao <shaojunyang@google.com>
commit 044c995af789121b9f5cef2206ef844ef6c8263b [browse]
Author: Brad Fitzpatrick
Date: 2026-05-22 03:50:05 Z
[release-branch.go1.26] runtime: tolerate vendor suffixes in Linux kernel release strings
Synology kernels can have a "_" in their uname version. Make the
parsing more tolerant. And also don't throw during init if we fail to
parse the kernel version. Instead, fall back to probing. (We can't
probe all the time, because seccomp filters on some platforms like
Android kill the process if we call a verbotenen system call)
This regressed in CL 758902 (forked from CL 751340) on 2026-03-24,
which started calling parseRelease unconditionally during osinit on
32-bit Linux.
Updates #79612
Fixes #79893
Change-Id: I98f61b94e54c7b9d08029f3aef664bdda9ec7f69
Reviewed-on: https://go-review.googlesource.com/c/go/+/781800
Reviewed-by: Jorropo <jorropo.pgm@gmail.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/793960
Auto-Submit: Junyang Shao <shaojunyang@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Junyang Shao <shaojunyang@google.com>
clone the repository to get more history