Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net/url: URL allows malformed query round trip [1.10 backport] #29922

Closed
gopherbot opened this issue Jan 24, 2019 · 11 comments
Closed

net/url: URL allows malformed query round trip [1.10 backport] #29922

gopherbot opened this issue Jan 24, 2019 · 11 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Milestone
Go1.10.9

Comments

@gopherbot
Copy link

@FiloSottile requested issue #22907 to be considered for backport to the next 1.10 minor release.

@gopherbot please open backport issues.

This has security implications, and CL 159157 is safe enough to backport.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Jan 24, 2019
@gopherbot gopherbot mentioned this issue Jan 24, 2019
Open
@gopherbot gopherbot added this to the Go1.10.9 milestone Jan 24, 2019
@FiloSottile FiloSottile added CherryPickApproved Used during the release process for point releases and removed CherryPickCandidate Used during the release process for point releases labels Jan 24, 2019
@dmitshur
Copy link
Contributor

I will make a cherry-pick CL for this.

I am using this as an opportunity to verify an answer I am planning to provide to this question.

@dmitshur dmitshur assigned dmitshur and unassigned bradfitz Jan 24, 2019
@dmitshur dmitshur mentioned this issue Jan 24, 2019
Closed
@gopherbot
Copy link
Author

Change https://golang.org/cl/159478 mentions this issue: [release-branch.go1.10] net/url, net/http: reject control characters in URLs

@dmitshur
Copy link
Contributor

@bradfitz In CL 159478, you said:

[Code-Review -2] We're going to backport the later fix instead.

Should this issue lose its CherryPickApproved label and/or be closed? Or are you going to re-use it to backport that different fix (as mentioned in #29923 (comment))? In any case, leaving to you.

@dmitshur dmitshur assigned bradfitz and unassigned dmitshur Jan 31, 2019
@dmitshur dmitshur mentioned this issue Jan 31, 2019
Open
@FiloSottile
Copy link
Contributor

This should stay open until we backport something.

@gopherbot
Copy link
Author

Change https://golang.org/cl/160678 mentions this issue: [release-branch.go1.10] net/http, net/url: reject control characters in URLs

@gopherbot
Copy link
Author

Closed by merging d4cf10b to release-branch.go1.10.

gopherbot pushed a commit that referenced this issue Feb 1, 2019
@bradfitz
[release-branch.go1.10] net/http, net/url: reject control characters …
d4cf10b 
…in URLs

Cherry pick of combined CL 159157 + CL 160178.

Fixes #29922
Updates #27302
Updates #22907

Change-Id: I6de92c14284595a58321a4b4d53229285979b872
Reviewed-on: https://go-review.googlesource.com/c/160678
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
@liggitt
Copy link
Contributor

liggitt commented Mar 27, 2019

is there a target 1.10.x release for d4cf10b?

@bradfitz
Copy link
Contributor

Go 1.10 is no longer maintained once Go 1.12 was released. We only support the past two released versions of Go.

@liggitt
Copy link
Contributor

liggitt commented Mar 27, 2019

Understood. I thought merging the security fix to the release branch implied a release would be cut. Unreleased security fixes sitting in the branch are unfortunate.

@liggitt
Copy link
Contributor

liggitt commented Mar 27, 2019

given this was deemed worthy of backport, and was backported on 2019-02-01 (prior to 1.12 being released on 2019-02-25), would it have been worthwhile to cut a 1.10.x release rolling up unreleased changes prior to dropping support because of 1.12?

@bradfitz
Copy link
Contributor

Its importance has been questioned elsewhere. It's not a huge security issue. It's borderline.

@golang golang locked and limited conversation to collaborators Mar 26, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Projects
None yet
Milestone
Go1.10.9
Development

No branches or pull requests
5 participants
@bradfitz @liggitt @FiloSottile @dmitshur @gopherbot