Skip to content
This repository has been archived by the owner on Nov 27, 2023. It is now read-only.

Fix exec.LookPath on windows #1164

Closed
gtardif opened this issue Jan 20, 2021 · 6 comments
Closed

Fix exec.LookPath on windows #1164

gtardif opened this issue Jan 20, 2021 · 6 comments
Labels

Comments

@gtardif
Copy link
Contributor

gtardif commented Jan 20, 2021

We currently have a workaround for how we find the moby CLI on windows, to avoid looking up in CWD (cf https://github.com/docker/compose-cli/blob/main/cli/mobycli/resolvepath/lp_windows.go)

We should be able to remove this now that the original issue has been fixed in go 1.15.7, see golang/go#43783

@thaJeztah
Copy link
Member

We should be able to remove this now that the original issue has been fixed in go 1.15.7,

go 1.15 only fixes this for the go command itself (go build etc), but not for other uses of LookPath;

This has been fixed by altering the usage of os/exec.LookPath by the go command to reject the usage of any binaries that reside in the current directory. If you are interested in understanding whether your own programs have a problem, we’ve written a blog post about the underlying issue: https://blog.golang.org/path-security.

@thaJeztah
Copy link
Member

Fix for the go command can be found in this commit, which adds an internal package with a customised LookPath; golang/go@07e3195#diff-25560022006dcc0a0bf07fe3291119c24ca8b12d0f29d3ad01f7c8a55265af58R34-R43

@thaJeztah
Copy link
Member

Looks like they also included a fixed version in golang.org/x/sys (same thing as the internal package from above); see docker/docker-credential-helpers#195

@stale
Copy link

stale bot commented Jul 20, 2021

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the stale Inactive issue label Jul 20, 2021
@thaJeztah
Copy link
Member

.

@stale
Copy link

stale bot commented Jul 20, 2021

This issue has been automatically marked as not stale anymore due to the recent activity.

@stale stale bot removed the stale Inactive issue label Jul 20, 2021
@ndeloof ndeloof closed this as completed Sep 2, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

3 participants