4 ms·
While you can create and build a local package with U+FE0E in its file name, you cannot create or download a module using that character in a file name. So you
by rsc 2y ago
While you can create and build a local package with U+FE0E in its file name, you cannot create or download a module using that character in a file name. So you could run this attack in someone's top-level repo but not in any of their dependencies. That's something at least.
https://go.googlesource.com/mod/+/refs/heads/master/module/module.go#58 https://go.googlesource.com/mod/+/refs/heads/master/module/m...
https://go.googlesource.com/mod/+/refs/heads/master/module/module.go#272 https://go.googlesource.com/mod/+/refs/heads/master/module/m...
- donatj 2y agoHuh, that gives me a little pause. People who clone a project and compile it manually get different output than people who `go install` it? Is that inconsistency something that … should be fixed? Seems like it should be.
- rsc 2y agoPeople who go install it get an error that it's not a valid source tree at all.