From f2a56450f4feb316514aa0f5978a989fe6b1a328 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 9 Feb 2021 11:08:36 +0100 Subject: [PATCH] Use golang.org/x/sys/execabs instead of os/exec On Windows, the os/exec.{Command,CommandContext,LookPath} functions resolve command names that have neither path separators nor file extension (e.g., "git") by first looking in the current working directory before looking in the PATH environment variable. Go maintainers intended to match cmd.exe's historical behavior. However, this is pretty much never the intended behavior and as an abundance of precaution this patch prevents that when executing commands. This patch was prompted by the [Go 1.15.7 security fixes](https://blog.golang.org/path-security). Signed-off-by: Sebastiaan van Stijn --- pkg/security/grantvmgroupaccess_test.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkg/security/grantvmgroupaccess_test.go b/pkg/security/grantvmgroupaccess_test.go index 3a1705f..19da4b3 100644 --- a/pkg/security/grantvmgroupaccess_test.go +++ b/pkg/security/grantvmgroupaccess_test.go @@ -3,11 +3,12 @@ package security import ( "io/ioutil" "os" - "os/exec" "path/filepath" "regexp" "strings" "testing" + + exec "golang.org/x/sys/execabs" ) // TestGrantVmGroupAccess verifies for the three case of a file, a directory,