• Russ Cox's avatar
    cmd/go: accept only limited compiler and linker flags in #cgo directives · 1dcb5836
    Russ Cox authored
    Both gcc and clang accept an option -fplugin=code.so to load
    a plugin from the ELF shared object file code.so.
    Obviously that plugin can then do anything it wants
    during the build. This is contrary to the goal of "go get"
    never running untrusted code during the build.
    (What happens if you choose to run the result of
    the build is your responsibility.)
    
    Disallow this behavior by only allowing a small set of
    known command-line flags in #cgo CFLAGS directives
    (and #cgo LDFLAGS, etc).
    
    The new restrictions can be adjusted by the environment
    variables CGO_CFLAGS_ALLOW, CGO_CFLAGS_DISALLOW,
    and so on. See the documentation.
    
    In addition to excluding cgo-defined flags, we also have to
    make sure that when we pass file names on the command
    line, they don't look like flags. So we now refuse to build
    packages containing suspicious file names like -x.go.
    
    A wrinkle in all this is that GNU binutils uniformly accept
    @foo on the command line to mean "if the file foo exists,
    then substitute its contents for @foo in the command line".
    So we must also reject @x.go, flags and flag arguments
    beginning with @, and so on.
    
    Fixes #23672, CVE-2018-6574.
    
    Change-Id: I59e7c1355155c335a5c5ae0d2cf8fa7aa313940a
    Reviewed-on: https://team-review.git.corp.google.com/209949Reviewed-by: 's avatarIan Lance Taylor <iant@google.com>
    1dcb5836
noder.go 32.2 KB