cmd/go: panic when passing package paths with invalid UTF-8 characters to go get

[gazerro]

The go get command (and likely other subcommands) panics if a package path argument contains an invalid UTF-8 character.

$ go get golang.org/x/net/http/httpguts�v0.43.0
panic: regexp: Compile("^golang\\.org/x/net/http/httpguts\xb2v0\\.43\\.0$"): error parsing regexp: invalid UTF-8: `�v0\.43\.0$`

goroutine 3 [running]:
regexp.MustCompile({0x14000208de0, 0x2b})
        regexp/regexp.go:313 +0xb0
cmd/internal/pkgpattern.matchPatternInternal({0x16f5ff697?, 0x26?}, 0x1)
        cmd/internal/pkgpattern/pkgpattern.go:95 +0x27c
cmd/internal/pkgpattern.MatchPattern(...)
        cmd/internal/pkgpattern/pkgpattern.go:47
cmd/go/internal/modload.QueryPattern({0x1010024d0, 0x10143d1e0}, {0x16f5ff697, 0x26}, {0x100d92209, 0x7}, 0x14000136a40, 0x140005d56a0)
        cmd/go/internal/modload/query.go:687 +0xd4
cmd/go/internal/modget.(*resolver).queryPattern(0x16f5ff697?, {0x1010024d0, 0x10143d1e0}, {0x16f5ff697, 0x26}, {0x100d92209, 0x7}, 0x14000136a40)
        cmd/go/internal/modget/get.go:671 +0xa0
cmd/go/internal/modget.(*resolver).performPathQueries.func1.(*resolver).queryPath.1()
        cmd/go/internal/modget/get.go:1056 +0x248
cmd/go/internal/modget.(*query).pathOnce(0x1400028e9c0, {0x16f5ff697, 0x26}, 0x14000504f20)
        cmd/go/internal/modget/query.go:268 +0x7c
cmd/go/internal/modget.(*resolver).queryPath(...)
        cmd/go/internal/modget/get.go:1035
cmd/go/internal/modget.(*resolver).performPathQueries.func1()
        cmd/go/internal/modget/get.go:1023 +0x74
cmd/internal/par.(*Queue).Add.func1()
        cmd/internal/par/queue.go:58 +0x58
created by cmd/internal/par.(*Queue).Add in goroutine 1
        cmd/internal/par/queue.go:56 +0x184

[prattmic]

cc @golang/command-line

[adonovan]

Seems like matchPatternInternal should check for UTF-8 validity and return false otherwise. One other possibility is for regexp.QuoteMeta to replace invalid UTF-8 encodings with U+FFFD, though there are probably many good reasons not to do that.

[gazerro]

Seems like matchPatternInternal should check for UTF-8 validity and return false otherwise.

Yes, I think this is the safest change to go with.

[gopherbot]

Change https://go.dev/cl/700815 mentions this issue: cmd/go: check pattern for utf8 validity before call regexp.MustCompile