summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--meta/recipes-devtools/go/go-1.14.inc4
-rw-r--r--meta/recipes-devtools/go/go-1.14/0001-CVE-2022-32190.patch74
-rw-r--r--meta/recipes-devtools/go/go-1.14/0002-CVE-2022-32190.patch48
-rw-r--r--meta/recipes-devtools/go/go-1.14/0003-CVE-2022-32190.patch36
-rw-r--r--meta/recipes-devtools/go/go-1.14/0004-CVE-2022-32190.patch82
5 files changed, 244 insertions, 0 deletions
diff --git a/meta/recipes-devtools/go/go-1.14.inc b/meta/recipes-devtools/go/go-1.14.inc
index 540ea4e62d..2e1d8240f6 100644
--- a/meta/recipes-devtools/go/go-1.14.inc
+++ b/meta/recipes-devtools/go/go-1.14.inc
@@ -37,6 +37,10 @@ SRC_URI += "\
37 file://CVE-2021-39293.patch \ 37 file://CVE-2021-39293.patch \
38 file://CVE-2021-41771.patch \ 38 file://CVE-2021-41771.patch \
39 file://CVE-2022-27664.patch \ 39 file://CVE-2022-27664.patch \
40 file://0001-CVE-2022-32190.patch \
41 file://0002-CVE-2022-32190.patch \
42 file://0003-CVE-2022-32190.patch \
43 file://0004-CVE-2022-32190.patch \
40" 44"
41 45
42SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch" 46SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch"
diff --git a/meta/recipes-devtools/go/go-1.14/0001-CVE-2022-32190.patch b/meta/recipes-devtools/go/go-1.14/0001-CVE-2022-32190.patch
new file mode 100644
index 0000000000..ad263b8023
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.14/0001-CVE-2022-32190.patch
@@ -0,0 +1,74 @@
1From 755f2dc35a19e6806de3ecbf836fa06ad875c67a Mon Sep 17 00:00:00 2001
2From: Carl Johnson <me@carlmjohnson.net>
3Date: Fri, 4 Mar 2022 14:49:52 +0000
4Subject: [PATCH 1/4] net/url: add JoinPath, URL.JoinPath
5
6Builds on CL 332209.
7
8Fixes #47005
9
10Change-Id: I82708dede05d79a196ca63f5a4e7cb5ac9a041ea
11GitHub-Last-Rev: 51b735066eef74f5e67c3e8899c58f44c0383c61
12GitHub-Pull-Request: golang/go#50383
13Reviewed-on: https://go-review.googlesource.com/c/go/+/374654
14Reviewed-by: Russ Cox <rsc@golang.org>
15Auto-Submit: Russ Cox <rsc@golang.org>
16Trust: Ian Lance Taylor <iant@golang.org>
17Reviewed-by: Damien Neil <dneil@google.com>
18Run-TryBot: Ian Lance Taylor <iant@golang.org>
19TryBot-Result: Gopher Robot <gobot@golang.org>
20
21Upstream-Status: Backport [https://github.com/golang/go/commit/604140d93111f89911e17cb147dcf6a02d2700d0]
22CVE: CVE-2022-32190
23Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
24---
25 src/net/url/url.go | 23 +++++++++++++++++++++++
26 1 file changed, 23 insertions(+)
27
28diff --git a/src/net/url/url.go b/src/net/url/url.go
29index 2880e82..dea8bfe 100644
30--- a/src/net/url/url.go
31+++ b/src/net/url/url.go
32@@ -13,6 +13,7 @@ package url
33 import (
34 "errors"
35 "fmt"
36+ "path"
37 "sort"
38 "strconv"
39 "strings"
40@@ -1104,6 +1105,17 @@ func (u *URL) UnmarshalBinary(text []byte) error {
41 return nil
42 }
43
44+// JoinPath returns a new URL with the provided path elements joined to
45+// any existing path and the resulting path cleaned of any ./ or ../ elements.
46+func (u *URL) JoinPath(elem ...string) *URL {
47+ url := *u
48+ if len(elem) > 0 {
49+ elem = append([]string{u.Path}, elem...)
50+ url.setPath(path.Join(elem...))
51+ }
52+ return &url
53+}
54+
55 // validUserinfo reports whether s is a valid userinfo string per RFC 3986
56 // Section 3.2.1:
57 // userinfo = *( unreserved / pct-encoded / sub-delims / ":" )
58@@ -1144,3 +1156,14 @@ func stringContainsCTLByte(s string) bool {
59 }
60 return false
61 }
62+
63+// JoinPath returns a URL string with the provided path elements joined to
64+// the existing path of base and the resulting path cleaned of any ./ or ../ elements.
65+func JoinPath(base string, elem ...string) (result string, err error) {
66+ url, err := Parse(base)
67+ if err != nil {
68+ return
69+ }
70+ result = url.JoinPath(elem...).String()
71+ return
72+}
73--
742.7.4
diff --git a/meta/recipes-devtools/go/go-1.14/0002-CVE-2022-32190.patch b/meta/recipes-devtools/go/go-1.14/0002-CVE-2022-32190.patch
new file mode 100644
index 0000000000..1a11cc72bc
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.14/0002-CVE-2022-32190.patch
@@ -0,0 +1,48 @@
1From 985108de87e7d2ecb2b28cb53b323d530387b884 Mon Sep 17 00:00:00 2001
2From: Ian Lance Taylor <iant@golang.org>
3Date: Thu, 31 Mar 2022 13:21:39 -0700
4Subject: [PATCH 2/4] net/url: preserve a trailing slash in JoinPath
5
6Fixes #52074
7
8Change-Id: I30897f32e70a6ca0c4e11aaf07088c27336efaba
9Reviewed-on: https://go-review.googlesource.com/c/go/+/397256
10Trust: Ian Lance Taylor <iant@golang.org>
11Run-TryBot: Ian Lance Taylor <iant@golang.org>
12TryBot-Result: Gopher Robot <gobot@golang.org>
13Reviewed-by: Matt Layher <mdlayher@gmail.com>
14Trust: Matt Layher <mdlayher@gmail.com>
15
16Upstream-Status: Backport [https://github.com/golang/go/commit/dbb52cc9f3e83a3040f46c2ae7650c15ab342179]
17CVE: CVE-2022-32190
18Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
19---
20 src/net/url/url.go | 9 ++++++++-
21 1 file changed, 8 insertions(+), 1 deletion(-)
22
23diff --git a/src/net/url/url.go b/src/net/url/url.go
24index dea8bfe..3436707 100644
25--- a/src/net/url/url.go
26+++ b/src/net/url/url.go
27@@ -1107,11 +1107,18 @@ func (u *URL) UnmarshalBinary(text []byte) error {
28
29 // JoinPath returns a new URL with the provided path elements joined to
30 // any existing path and the resulting path cleaned of any ./ or ../ elements.
31+// Any sequences of multiple / characters will be reduced to a single /.
32 func (u *URL) JoinPath(elem ...string) *URL {
33 url := *u
34 if len(elem) > 0 {
35 elem = append([]string{u.Path}, elem...)
36- url.setPath(path.Join(elem...))
37+ p := path.Join(elem...)
38+ // path.Join will remove any trailing slashes.
39+ // Preserve at least one.
40+ if strings.HasSuffix(elem[len(elem)-1], "/") && !strings.HasSuffix(p, "/") {
41+ p += "/"
42+ }
43+ url.setPath(p)
44 }
45 return &url
46 }
47--
482.7.4
diff --git a/meta/recipes-devtools/go/go-1.14/0003-CVE-2022-32190.patch b/meta/recipes-devtools/go/go-1.14/0003-CVE-2022-32190.patch
new file mode 100644
index 0000000000..816d914983
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.14/0003-CVE-2022-32190.patch
@@ -0,0 +1,36 @@
1From 2c632b883b0f11084cc247c8b50ad6c71fa7b447 Mon Sep 17 00:00:00 2001
2From: Sean Liao <sean@liao.dev>
3Date: Sat, 9 Jul 2022 18:38:45 +0100
4Subject: [PATCH 3/4] net/url: use EscapedPath for url.JoinPath
5
6Fixes #53763
7
8Change-Id: I08b53f159ebdce7907e8cc17316fd0c982363239
9Reviewed-on: https://go-review.googlesource.com/c/go/+/416774
10TryBot-Result: Gopher Robot <gobot@golang.org>
11Reviewed-by: Damien Neil <dneil@google.com>
12Reviewed-by: Bryan Mills <bcmills@google.com>
13Run-TryBot: Ian Lance Taylor <iant@golang.org>
14
15Upstream-Status: Backport [https://github.com/golang/go/commit/bf5898ef53d1693aa572da0da746c05e9a6f15c5]
16CVE: CVE-2022-32190
17Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
18---
19 src/net/url/url.go | 2 +-
20 1 file changed, 1 insertion(+), 1 deletion(-)
21
22diff --git a/src/net/url/url.go b/src/net/url/url.go
23index 3436707..73079a5 100644
24--- a/src/net/url/url.go
25+++ b/src/net/url/url.go
26@@ -1111,7 +1111,7 @@ func (u *URL) UnmarshalBinary(text []byte) error {
27 func (u *URL) JoinPath(elem ...string) *URL {
28 url := *u
29 if len(elem) > 0 {
30- elem = append([]string{u.Path}, elem...)
31+ elem = append([]string{u.EscapedPath()}, elem...)
32 p := path.Join(elem...)
33 // path.Join will remove any trailing slashes.
34 // Preserve at least one.
35--
362.7.4
diff --git a/meta/recipes-devtools/go/go-1.14/0004-CVE-2022-32190.patch b/meta/recipes-devtools/go/go-1.14/0004-CVE-2022-32190.patch
new file mode 100644
index 0000000000..4bdff3aed4
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.14/0004-CVE-2022-32190.patch
@@ -0,0 +1,82 @@
1From f61e428699cbb52bab31fe2c124f49d085a209fe Mon Sep 17 00:00:00 2001
2From: Damien Neil <dneil@google.com>
3Date: Fri, 12 Aug 2022 16:21:09 -0700
4Subject: [PATCH 4/4] net/url: consistently remove ../ elements in JoinPath
5
6JoinPath would fail to remove relative elements from the start of
7the path when the first path element is "".
8
9In addition, JoinPath would return the original path unmodified
10when provided with no elements to join, violating the documented
11behavior of always cleaning the resulting path.
12
13Correct both these cases.
14
15 JoinPath("http://go.dev", "../go")
16 // before: http://go.dev/../go
17 // after: http://go.dev/go
18
19 JoinPath("http://go.dev/../go")
20 // before: http://go.dev/../go
21 // after: http://go.dev/go
22
23For #54385.
24Fixes #54635.
25Fixes CVE-2022-32190.
26
27Change-Id: I6d22cd160d097c50703dd96e4f453c6c118fd5d9
28Reviewed-on: https://go-review.googlesource.com/c/go/+/423514
29Reviewed-by: David Chase <drchase@google.com>
30Reviewed-by: Alan Donovan <adonovan@google.com>
31(cherry picked from commit 0765da5884adcc8b744979303a36a27092d8fc51)
32Reviewed-on: https://go-review.googlesource.com/c/go/+/425357
33Run-TryBot: Damien Neil <dneil@google.com>
34TryBot-Result: Gopher Robot <gobot@golang.org>
35
36Upstream-Status: Backport [https://github.com/golang/go/commit/28335508913a46e05ef0c04a18e8a1a6beb775ec]
37CVE: CVE-2022-32190
38Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
39---
40 src/net/url/url.go | 26 ++++++++++++++++----------
41 1 file changed, 16 insertions(+), 10 deletions(-)
42
43diff --git a/src/net/url/url.go b/src/net/url/url.go
44index 73079a5..1e8baf9 100644
45--- a/src/net/url/url.go
46+++ b/src/net/url/url.go
47@@ -1109,17 +1109,23 @@ func (u *URL) UnmarshalBinary(text []byte) error {
48 // any existing path and the resulting path cleaned of any ./ or ../ elements.
49 // Any sequences of multiple / characters will be reduced to a single /.
50 func (u *URL) JoinPath(elem ...string) *URL {
51- url := *u
52- if len(elem) > 0 {
53- elem = append([]string{u.EscapedPath()}, elem...)
54- p := path.Join(elem...)
55- // path.Join will remove any trailing slashes.
56- // Preserve at least one.
57- if strings.HasSuffix(elem[len(elem)-1], "/") && !strings.HasSuffix(p, "/") {
58- p += "/"
59- }
60- url.setPath(p)
61+ elem = append([]string{u.EscapedPath()}, elem...)
62+ var p string
63+ if !strings.HasPrefix(elem[0], "/") {
64+ // Return a relative path if u is relative,
65+ // but ensure that it contains no ../ elements.
66+ elem[0] = "/" + elem[0]
67+ p = path.Join(elem...)[1:]
68+ } else {
69+ p = path.Join(elem...)
70 }
71+ // path.Join will remove any trailing slashes.
72+ // Preserve at least one.
73+ if strings.HasSuffix(elem[len(elem)-1], "/") && !strings.HasSuffix(p, "/") {
74+ p += "/"
75+ }
76+ url := *u
77+ url.setPath(p)
78 return &url
79 }
80
81--
822.7.4