Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Go 1.20: archive/zip fails due to unimplemented godebug.setUpdate #3408

Closed
QuLogic opened this issue Jan 23, 2023 · 3 comments
Closed

Go 1.20: archive/zip fails due to unimplemented godebug.setUpdate #3408

QuLogic opened this issue Jan 23, 2023 · 3 comments

Comments

@QuLogic
Copy link
Contributor

QuLogic commented Jan 23, 2023

Running with #3391 properly this time, it appears there are only test failures in archive/zip:

--- FAIL: TestCVE202127919 (0.00s)
    Error reading the archive: <nil>
    FailNow is incomplete, requires runtime.Goexit()
--- FAIL: TestCVE202141772 (0.00s)
    Error reading the archive: <nil>
    FailNow is incomplete, requires runtime.Goexit()
--- FAIL: TestInsecurePaths (0.00s)
    NewReader for archive with file "../foo": got err <nil>, want ErrInsecurePath
    NewReader for archive with file "/foo": got err <nil>, want ErrInsecurePath
    NewReader for archive with file "a/b/../../../c": got err <nil>, want ErrInsecurePath
    NewReader for archive with file "a\\b": got err <nil>, want ErrInsecurePath
FAIL
FAIL	archive/zip	62.713s

This is because these three tests call t.Setenv("GODEBUG", "zipinsecurepath=0"), which requires refreshing the GODEBUG settings so that archive/zip will return an error. But since #3391 only added a stub for setUpdate, the refresh doesn't happen, no error is returned, and those tests fail.

@aykevl
Copy link
Member

aykevl commented Jan 25, 2023

Thank you for the investigation! Yes, I encountered this error while working on #3391 but didn't investigate it yet (#3391 was focused on fixing the most apparent Go 1.20 breakage, not to add full support for everything).

Feel free to submit a PR with a fix, otherwise I'll probably get around to it around the time Go 1.20 is released.

@aykevl
Copy link
Member

aykevl commented Feb 2, 2023

See: #3426

@dgryski dgryski added the next-release Will be part of next release label Feb 8, 2023
@deadprogram
Copy link
Member

0.27.0 has now been released, so closing.

@deadprogram deadprogram removed the next-release Will be part of next release label Feb 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants