GoStdLib: add CGO_LDFLAGS to CGO_LDFLAGS_ALLOW (#2714)

For golang/go#42565
For #2710

go/tools/builders/stdlib.go

@@ -20,6 +20,7 @@ import (
 	"go/build"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 )
 
@@ -91,6 +92,18 @@ You may need to use the flags --cpu=x64_windows --compiler=mingw-gcc.`)
 	os.Setenv("CGO_CFLAGS", os.Getenv("CGO_CFLAGS")+" "+strings.Join(defaultCFlags(output), " "))
 	os.Setenv("CGO_LDFLAGS", os.Getenv("CGO_LDFLAGS")+" "+strings.Join(defaultLdFlags(), " "))
 
+	// Allow flags in CGO_LDFLAGS that wouldn't pass the security check.
+	// Workaround for golang.org/issue/42565.
+	var b strings.Builder
+	sep := ""
+	cgoLdflags, _ := splitQuoted(os.Getenv("CGO_LDFLAGS"))
+	for _, f := range cgoLdflags {
+		b.WriteString(sep)
+		sep = "|"
+		b.WriteString(regexp.QuoteMeta(f))
+	}
+	os.Setenv("CGO_LDFLAGS_ALLOW", b.String())
+
 	// Build the commands needed to build the std library in the right mode
 	// NOTE: the go command stamps compiled .a files with build ids, which are
 	// cryptographic sums derived from the inputs. This prevents us from