From 6e0a048916c12881f8d3643fe3fbee83d3c0a96d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 11 Oct 2023 23:20:53 +0000 Subject: [PATCH] Bump golang.org/x/net from 0.7.0 to 0.17.0 Bumps [golang.org/x/net](https://github.com/golang/net) from 0.7.0 to 0.17.0. - [Commits](https://github.com/golang/net/compare/v0.7.0...v0.17.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- go.mod | 4 +- go.sum | 8 +- vendor/golang.org/x/net/html/doc.go | 21 ++ vendor/golang.org/x/net/html/escape.go | 81 +++++ vendor/golang.org/x/net/html/render.go | 30 +- vendor/golang.org/x/net/html/token.go | 19 +- .../sys/internal/unsafeheader/unsafeheader.go | 30 -- vendor/golang.org/x/sys/unix/ioctl_signed.go | 70 +++++ .../sys/unix/{ioctl.go => ioctl_unsigned.go} | 21 +- vendor/golang.org/x/sys/unix/ioctl_zos.go | 20 +- vendor/golang.org/x/sys/unix/mkall.sh | 2 +- vendor/golang.org/x/sys/unix/mkerrors.sh | 14 +- vendor/golang.org/x/sys/unix/mmap_nomremap.go | 14 + vendor/golang.org/x/sys/unix/mremap.go | 53 ++++ vendor/golang.org/x/sys/unix/syscall_aix.go | 24 +- .../golang.org/x/sys/unix/syscall_aix_ppc.go | 1 - .../x/sys/unix/syscall_aix_ppc64.go | 1 - vendor/golang.org/x/sys/unix/syscall_bsd.go | 17 +- .../golang.org/x/sys/unix/syscall_darwin.go | 251 +++------------- .../x/sys/unix/syscall_dragonfly.go | 200 +------------ .../golang.org/x/sys/unix/syscall_freebsd.go | 236 +++------------ .../x/sys/unix/syscall_freebsd_386.go | 17 +- .../x/sys/unix/syscall_freebsd_amd64.go | 17 +- .../x/sys/unix/syscall_freebsd_arm.go | 15 +- .../x/sys/unix/syscall_freebsd_arm64.go | 15 +- .../x/sys/unix/syscall_freebsd_riscv64.go | 15 +- vendor/golang.org/x/sys/unix/syscall_hurd.go | 8 + vendor/golang.org/x/sys/unix/syscall_linux.go | 266 ++++++++--------- .../x/sys/unix/syscall_linux_386.go | 27 -- .../x/sys/unix/syscall_linux_amd64.go | 3 +- .../x/sys/unix/syscall_linux_arm.go | 27 -- .../x/sys/unix/syscall_linux_arm64.go | 12 +- .../x/sys/unix/syscall_linux_loong64.go | 7 +- .../x/sys/unix/syscall_linux_mips64x.go | 3 +- .../x/sys/unix/syscall_linux_mipsx.go | 27 -- .../x/sys/unix/syscall_linux_ppc.go | 27 -- .../x/sys/unix/syscall_linux_ppc64x.go | 1 - .../x/sys/unix/syscall_linux_riscv64.go | 14 +- .../x/sys/unix/syscall_linux_s390x.go | 1 - .../x/sys/unix/syscall_linux_sparc64.go | 1 - .../golang.org/x/sys/unix/syscall_netbsd.go | 279 +---------------- .../golang.org/x/sys/unix/syscall_openbsd.go | 93 +----- .../golang.org/x/sys/unix/syscall_solaris.go | 68 ++--- vendor/golang.org/x/sys/unix/syscall_unix.go | 18 ++ .../x/sys/unix/syscall_zos_s390x.go | 21 +- .../x/sys/unix/zerrors_darwin_amd64.go | 19 ++ .../x/sys/unix/zerrors_darwin_arm64.go | 19 ++ vendor/golang.org/x/sys/unix/zerrors_linux.go | 76 ++++- .../x/sys/unix/zerrors_linux_386.go | 11 + .../x/sys/unix/zerrors_linux_amd64.go | 11 + .../x/sys/unix/zerrors_linux_arm.go | 11 + .../x/sys/unix/zerrors_linux_arm64.go | 13 + .../x/sys/unix/zerrors_linux_loong64.go | 13 + .../x/sys/unix/zerrors_linux_mips.go | 11 + .../x/sys/unix/zerrors_linux_mips64.go | 11 + .../x/sys/unix/zerrors_linux_mips64le.go | 11 + .../x/sys/unix/zerrors_linux_mipsle.go | 11 + .../x/sys/unix/zerrors_linux_ppc.go | 11 + .../x/sys/unix/zerrors_linux_ppc64.go | 11 + .../x/sys/unix/zerrors_linux_ppc64le.go | 11 + .../x/sys/unix/zerrors_linux_riscv64.go | 11 + .../x/sys/unix/zerrors_linux_s390x.go | 11 + .../x/sys/unix/zerrors_linux_sparc64.go | 59 ++++ .../x/sys/unix/zptrace_armnn_linux.go | 8 +- .../x/sys/unix/zptrace_linux_arm64.go | 4 +- .../x/sys/unix/zptrace_mipsnn_linux.go | 8 +- .../x/sys/unix/zptrace_mipsnnle_linux.go | 8 +- .../x/sys/unix/zptrace_x86_linux.go | 8 +- .../golang.org/x/sys/unix/zsyscall_aix_ppc.go | 45 +-- .../x/sys/unix/zsyscall_aix_ppc64.go | 46 +-- .../x/sys/unix/zsyscall_aix_ppc64_gc.go | 17 +- .../x/sys/unix/zsyscall_aix_ppc64_gccgo.go | 18 +- .../x/sys/unix/zsyscall_darwin_amd64.go | 71 +++-- .../x/sys/unix/zsyscall_darwin_amd64.s | 160 +--------- .../x/sys/unix/zsyscall_darwin_arm64.go | 71 +++-- .../x/sys/unix/zsyscall_darwin_arm64.s | 160 +--------- .../x/sys/unix/zsyscall_dragonfly_amd64.go | 42 +-- .../x/sys/unix/zsyscall_freebsd_386.go | 52 ++-- .../x/sys/unix/zsyscall_freebsd_amd64.go | 52 ++-- .../x/sys/unix/zsyscall_freebsd_arm.go | 52 ++-- .../x/sys/unix/zsyscall_freebsd_arm64.go | 52 ++-- .../x/sys/unix/zsyscall_freebsd_riscv64.go | 52 ++-- .../x/sys/unix/zsyscall_illumos_amd64.go | 10 +- .../golang.org/x/sys/unix/zsyscall_linux.go | 89 +++--- .../x/sys/unix/zsyscall_linux_386.go | 10 - .../x/sys/unix/zsyscall_linux_amd64.go | 10 - .../x/sys/unix/zsyscall_linux_arm.go | 10 - .../x/sys/unix/zsyscall_linux_arm64.go | 10 - .../x/sys/unix/zsyscall_linux_mips.go | 10 - .../x/sys/unix/zsyscall_linux_mips64.go | 10 - .../x/sys/unix/zsyscall_linux_mips64le.go | 10 - .../x/sys/unix/zsyscall_linux_mipsle.go | 10 - .../x/sys/unix/zsyscall_linux_ppc.go | 10 - .../x/sys/unix/zsyscall_linux_ppc64.go | 10 - .../x/sys/unix/zsyscall_linux_ppc64le.go | 10 - .../x/sys/unix/zsyscall_linux_riscv64.go | 26 +- .../x/sys/unix/zsyscall_linux_s390x.go | 10 - .../x/sys/unix/zsyscall_linux_sparc64.go | 10 - .../x/sys/unix/zsyscall_netbsd_386.go | 49 ++- .../x/sys/unix/zsyscall_netbsd_amd64.go | 49 ++- .../x/sys/unix/zsyscall_netbsd_arm.go | 49 ++- .../x/sys/unix/zsyscall_netbsd_arm64.go | 49 ++- .../x/sys/unix/zsyscall_openbsd_386.go | 68 ++--- .../x/sys/unix/zsyscall_openbsd_386.s | 15 +- .../x/sys/unix/zsyscall_openbsd_amd64.go | 68 ++--- .../x/sys/unix/zsyscall_openbsd_amd64.s | 15 +- .../x/sys/unix/zsyscall_openbsd_arm.go | 68 ++--- .../x/sys/unix/zsyscall_openbsd_arm.s | 15 +- .../x/sys/unix/zsyscall_openbsd_arm64.go | 68 ++--- .../x/sys/unix/zsyscall_openbsd_arm64.s | 15 +- .../x/sys/unix/zsyscall_openbsd_mips64.go | 68 ++--- .../x/sys/unix/zsyscall_openbsd_mips64.s | 15 +- .../x/sys/unix/zsyscall_openbsd_ppc64.go | 68 ++--- .../x/sys/unix/zsyscall_openbsd_ppc64.s | 18 +- .../x/sys/unix/zsyscall_openbsd_riscv64.go | 68 ++--- .../x/sys/unix/zsyscall_openbsd_riscv64.s | 15 +- .../x/sys/unix/zsyscall_solaris_amd64.go | 280 +++++++++--------- .../x/sys/unix/zsyscall_zos_s390x.go | 23 +- .../x/sys/unix/zsysnum_linux_386.go | 1 + .../x/sys/unix/zsysnum_linux_amd64.go | 1 + .../x/sys/unix/zsysnum_linux_arm.go | 1 + .../x/sys/unix/zsysnum_linux_arm64.go | 1 + .../x/sys/unix/zsysnum_linux_loong64.go | 1 + .../x/sys/unix/zsysnum_linux_mips.go | 1 + .../x/sys/unix/zsysnum_linux_mips64.go | 1 + .../x/sys/unix/zsysnum_linux_mips64le.go | 1 + .../x/sys/unix/zsysnum_linux_mipsle.go | 1 + .../x/sys/unix/zsysnum_linux_ppc.go | 1 + .../x/sys/unix/zsysnum_linux_ppc64.go | 1 + .../x/sys/unix/zsysnum_linux_ppc64le.go | 1 + .../x/sys/unix/zsysnum_linux_riscv64.go | 3 + .../x/sys/unix/zsysnum_linux_s390x.go | 2 + .../x/sys/unix/zsysnum_linux_sparc64.go | 1 + .../x/sys/unix/ztypes_darwin_amd64.go | 11 + .../x/sys/unix/ztypes_darwin_arm64.go | 11 + .../x/sys/unix/ztypes_freebsd_386.go | 2 +- .../x/sys/unix/ztypes_freebsd_amd64.go | 2 +- .../x/sys/unix/ztypes_freebsd_arm.go | 2 +- .../x/sys/unix/ztypes_freebsd_arm64.go | 2 +- .../x/sys/unix/ztypes_freebsd_riscv64.go | 2 +- vendor/golang.org/x/sys/unix/ztypes_linux.go | 225 +++++++++++--- .../golang.org/x/sys/unix/ztypes_linux_386.go | 4 +- .../x/sys/unix/ztypes_linux_amd64.go | 4 +- .../golang.org/x/sys/unix/ztypes_linux_arm.go | 4 +- .../x/sys/unix/ztypes_linux_arm64.go | 4 +- .../x/sys/unix/ztypes_linux_loong64.go | 4 +- .../x/sys/unix/ztypes_linux_mips.go | 4 +- .../x/sys/unix/ztypes_linux_mips64.go | 4 +- .../x/sys/unix/ztypes_linux_mips64le.go | 4 +- .../x/sys/unix/ztypes_linux_mipsle.go | 4 +- .../golang.org/x/sys/unix/ztypes_linux_ppc.go | 4 +- .../x/sys/unix/ztypes_linux_ppc64.go | 4 +- .../x/sys/unix/ztypes_linux_ppc64le.go | 4 +- .../x/sys/unix/ztypes_linux_riscv64.go | 31 +- .../x/sys/unix/ztypes_linux_s390x.go | 4 +- .../x/sys/unix/ztypes_linux_sparc64.go | 4 +- .../golang.org/x/sys/windows/env_windows.go | 6 +- .../golang.org/x/sys/windows/exec_windows.go | 92 +++++- .../x/sys/windows/security_windows.go | 21 +- vendor/golang.org/x/sys/windows/service.go | 11 + .../x/sys/windows/syscall_windows.go | 76 +++-- .../golang.org/x/sys/windows/types_windows.go | 102 ++++++- .../x/sys/windows/zsyscall_windows.go | 98 +++++- vendor/modules.txt | 5 +- 164 files changed, 2435 insertions(+), 3032 deletions(-) delete mode 100644 vendor/golang.org/x/sys/internal/unsafeheader/unsafeheader.go create mode 100644 vendor/golang.org/x/sys/unix/ioctl_signed.go rename vendor/golang.org/x/sys/unix/{ioctl.go => ioctl_unsigned.go} (76%) create mode 100644 vendor/golang.org/x/sys/unix/mmap_nomremap.go create mode 100644 vendor/golang.org/x/sys/unix/mremap.go diff --git a/go.mod b/go.mod index d113bf4..97f0249 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/sirupsen/logrus v1.9.0 github.com/urfave/cli/v2 v2.20.3 golang.org/x/mod v0.6.0 - golang.org/x/net v0.7.0 + golang.org/x/net v0.17.0 ) require ( @@ -15,5 +15,5 @@ require ( github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/stretchr/testify v1.8.1 // indirect github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect - golang.org/x/sys v0.5.0 // indirect + golang.org/x/sys v0.13.0 // indirect ) diff --git a/go.sum b/go.sum index d99e10b..113e34f 100644 --- a/go.sum +++ b/go.sum @@ -25,11 +25,11 @@ github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRT github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8= golang.org/x/mod v0.6.0 h1:b9gGHsz9/HhJ3HF5DHQytPpuwocVTChQJK3AvoLRD5I= golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI= -golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= -golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM= +golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= -golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= +golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= diff --git a/vendor/golang.org/x/net/html/doc.go b/vendor/golang.org/x/net/html/doc.go index 822ed42..2466ae3 100644 --- a/vendor/golang.org/x/net/html/doc.go +++ b/vendor/golang.org/x/net/html/doc.go @@ -92,6 +92,27 @@ example, to process each anchor node in depth-first order: The relevant specifications include: https://html.spec.whatwg.org/multipage/syntax.html and https://html.spec.whatwg.org/multipage/syntax.html#tokenization + +# Security Considerations + +Care should be taken when parsing and interpreting HTML, whether full documents +or fragments, within the framework of the HTML specification, especially with +regard to untrusted inputs. + +This package provides both a tokenizer and a parser, which implement the +tokenization, and tokenization and tree construction stages of the WHATWG HTML +parsing specification respectively. While the tokenizer parses and normalizes +individual HTML tokens, only the parser constructs the DOM tree from the +tokenized HTML, as described in the tree construction stage of the +specification, dynamically modifying or extending the docuemnt's DOM tree. + +If your use case requires semantically well-formed HTML documents, as defined by +the WHATWG specification, the parser should be used rather than the tokenizer. + +In security contexts, if trust decisions are being made using the tokenized or +parsed content, the input must be re-serialized (for instance by using Render or +Token.String) in order for those trust decisions to hold, as the process of +tokenization or parsing may alter the content. */ package html // import "golang.org/x/net/html" diff --git a/vendor/golang.org/x/net/html/escape.go b/vendor/golang.org/x/net/html/escape.go index d856139..04c6bec 100644 --- a/vendor/golang.org/x/net/html/escape.go +++ b/vendor/golang.org/x/net/html/escape.go @@ -193,6 +193,87 @@ func lower(b []byte) []byte { return b } +// escapeComment is like func escape but escapes its input bytes less often. +// Per https://github.com/golang/go/issues/58246 some HTML comments are (1) +// meaningful and (2) contain angle brackets that we'd like to avoid escaping +// unless we have to. +// +// "We have to" includes the '&' byte, since that introduces other escapes. +// +// It also includes those bytes (not including EOF) that would otherwise end +// the comment. Per the summary table at the bottom of comment_test.go, this is +// the '>' byte that, per above, we'd like to avoid escaping unless we have to. +// +// Studying the summary table (and T actions in its '>' column) closely, we +// only need to escape in states 43, 44, 49, 51 and 52. State 43 is at the +// start of the comment data. State 52 is after a '!'. The other three states +// are after a '-'. +// +// Our algorithm is thus to escape every '&' and to escape '>' if and only if: +// - The '>' is after a '!' or '-' (in the unescaped data) or +// - The '>' is at the start of the comment data (after the opening ""); err != nil { @@ -194,9 +194,8 @@ func render1(w writer, n *Node) error { } } - // Render any child nodes. - switch n.Data { - case "iframe", "noembed", "noframes", "noscript", "plaintext", "script", "style", "xmp": + // Render any child nodes + if childTextNodesAreLiteral(n) { for c := n.FirstChild; c != nil; c = c.NextSibling { if c.Type == TextNode { if _, err := w.WriteString(c.Data); err != nil { @@ -213,7 +212,7 @@ func render1(w writer, n *Node) error { // last element in the file, with no closing tag. return plaintextAbort } - default: + } else { for c := n.FirstChild; c != nil; c = c.NextSibling { if err := render1(w, c); err != nil { return err @@ -231,6 +230,27 @@ func render1(w writer, n *Node) error { return w.WriteByte('>') } +func childTextNodesAreLiteral(n *Node) bool { + // Per WHATWG HTML 13.3, if the parent of the current node is a style, + // script, xmp, iframe, noembed, noframes, or plaintext element, and the + // current node is a text node, append the value of the node's data + // literally. The specification is not explicit about it, but we only + // enforce this if we are in the HTML namespace (i.e. when the namespace is + // ""). + // NOTE: we also always include noscript elements, although the + // specification states that they should only be rendered as such if + // scripting is enabled for the node (which is not something we track). + if n.Namespace != "" { + return false + } + switch n.Data { + case "iframe", "noembed", "noframes", "noscript", "plaintext", "script", "style", "xmp": + return true + default: + return false + } +} + // writeQuoted writes s to w surrounded by quotes. Normally it will use double // quotes, but if s contains a double quote, it will use single quotes. // It is used for writing the identifiers in a doctype declaration. diff --git a/vendor/golang.org/x/net/html/token.go b/vendor/golang.org/x/net/html/token.go index 50f7c6a..de67f93 100644 --- a/vendor/golang.org/x/net/html/token.go +++ b/vendor/golang.org/x/net/html/token.go @@ -110,7 +110,7 @@ func (t Token) String() string { case SelfClosingTagToken: return "<" + t.tagString() + "/>" case CommentToken: - return "" + return "" case DoctypeToken: return "" } @@ -598,10 +598,10 @@ scriptDataDoubleEscapeEnd: // readComment reads the next comment token starting with "