golang.org/x/text@v0.42.0 security report

The C strings allocated by C.CString (loc and src) are never freed, and the ucasemap_t handle cm is never closed with ucasemap_close, causing memory leaks per invocation.

Uses unsafe.Pointer to pass a Go byte slice to C. While not inherently malicious, passing a pointer to a Go-managed slice to C code can lead to memory safety issues if the C code retains the pointer or if the slice is moved by GC.

The package contains two init() functions that execute at import time: one parses the availableLocales constant and populates the tags slice, and another (go:generate directive) is a comment for code generation. Both are benign and perform static locale parsing with no external interaction, network access, or file system manipulation.

The generator downloads CLDR data from the web via gen.OpenCLDRCoreZip(), which performs network requests. This is expected for a table generator, but it is a network dependency that could be a supply chain risk if the remote data is compromised.

The code downloads a ZIP archive from the network and extracts/parses files from it without cryptographic signature verification. A compromised remote source could deliver malicious CLDR data influencing generated tables.

gen.WriteGoFile("tables.go", *pkg, w.Bytes()) writes generated Go code to the current working directory outside of a clearly contained temp path. This is normal for a build-time generator but writes to an arbitrary path chosen by the caller.

The program fetches 'encodings.json' from the official WHATWG specification site (https://encoding.spec.whatwg.org). This is the intended purpose of this code generator and is not malicious.

The generator writes a generated Go source file ('tables.go') using gen.WriteGoFile. This is standard behavior for a code generation tool and is confined to the package's own scope.

This file is a Go code generator (build tag 'ignore') that parses the IANA character-sets XML registry and generates an iana index table. It does not contain any network requests, environment/credential harvesting, obfuscation, dynamic code execution, backdoors, reverse shells, crypto mining, or shell command execution.

The program downloads external files at generation time and writes them into the package's tables.go. Although the file is excluded from normal compilation via the 'ignore' build tag and is only run manually by maintainers, the generated output becomes part of the published package. Any compromise of the remote source or transport could poison the encoding tables. No signature or hash verification is performed on downloaded content.

The file contains a //go:build ignore directive and is a standalone generator program (package main). It is designed to be run manually with 'go run maketables.go | gofmt > tables.go' and does not execute at import time.

The file makes an HTTP GET request to encoding.spec.whatwg.org to download the EUC-KR encoding index. This is a legitimate, expected part of the table generation tool and is not used for data exfiltration.

The file is a build-time code generator with //go:build ignore, meaning it is not compiled into the package and only intended to be run manually via 'go run maketables.go'. However, executing it performs network requests and generates source code.

A top-level network fetch is performed when the file is executed with go run maketables.go. This is by design for table generation, but it means the build process depends on an external server and any compromise of that server (especially over HTTP) could affect generated output. No data exfiltration or credential harvesting is present, but the external dependency at generation time should be noted.

The code reads the GOROOT environment variable to construct file paths for modification. This is standard for Go tooling but could be manipulated to target unintended directories.

The code uses os/exec to run 'go generate' and 'go test' commands. While this is expected for a code generation tool, it could be abused if the package arguments are controlled by an attacker to execute arbitrary commands.

WriteGoFile and WriteVersionedGoFile call os.Create to create/write files at arbitrary paths specified by callers, and call log.Fatalf on error, which can terminate the process. While expected for a code generation utility in the Go standard library's internal packages, this is file system manipulation outside the immediate package scope.

WriteVersionedGoFile modifies the output filename via a format string (fileToPattern/updateBuildTags) and then writes to it, indirectly affecting which files are created. This depends on external UnicodeVersion and buildTags functions not shown here.

Uses reflect and gob encoding to serialize values from arbitrary interface{} inputs. gob.Decode is not used here (only Encode), which limits deserialization risks, but the reflection-heavy code path could be problematic if fed untrusted types. This is standard for codegen tooling.

writeSlice panics for unsupported element types ('gen: slice elem type not supported'), which can cause denial of service if invoked with unexpected inputs. Expected behavior for an internal generator library.

The code performs HTTP GET requests to external servers (unicode.org, iana.org) with URLs that are configurable via command-line flags or environment variables. While this appears to be legitimate data fetching for Unicode/CLDR code generation, the flexibility to redirect these requests to arbitrary URLs could be a security concern if used maliciously. The URLs are hardcoded defaults but can be overridden with -url and -iana flags.

The getEnv function reads environment variables to determine Unicode and CLDR versions, which are then used in file path construction when downloading files. An attacker who controls environment variables could potentially influence which files are downloaded and where they are stored, though the impact appears limited to the tool's intended use case.

The code downloads files from external sources and writes them to the local filesystem. It uses build.Import to locate the golang.org/x/text package and creates/reads/writes files in the DATA directory. While this is expected behavior for a code generation tool, it does modify files outside the immediate package scope. The tool creates directories and writes downloaded content with 0755 permissions.

Package contains an init() function that precomputes a scale table of powers of 10. This is benign, deterministic initialization with no side effects, network access, or external I/O.

Writes the provided source string to a temporary file and later removes it, but the content is controlled by the caller and could be used to write arbitrary files if the path were manipulated. The path is constructed safely with filepath.Join and a random temp dir, limiting risk.

The package contains an init() function that precomputes ASCII bidi properties into a package-level array. This runs at import time but performs only local, deterministic computation with no network, filesystem, or process interaction.

This is a Go code generator (build tag //go:build ignore) that downloads Unicode data files from the web via gen.OpenUCDFile (golang.org/x/text/internal/gen) and reads/subsequently writes Go source files into the package directory. It is intended as an offline maintainer tool, not runtime code, and does not ship in the compiled package. However, if executed in an untrusted build environment, it performs outbound network requests and writes to the local package scope (tables.go, data_test.go), which is a build-time side effect worth noting.

Numerous log.Fatal/log.Fatalf calls will terminate the process on unexpected input. This is normal for a generator but could be a DoS vector if the code were ever invoked with attacker-controlled Unicode data files.

The generated file includes a //go:generate directive that runs go run gen.go --versions=.... This is a common Go idiom, but go:generate directives can be abused to execute arbitrary commands if the file is modified by a compromised dependency.

The script uses gen.Open to fetch remote Unicode data from https://www.unicode.org/Public/. While this is a legitimate build-time code generation step protected by a //go:build ignore tag and does not execute at import time, it demonstrates network fetching behavior that could be repurposed in a malicious fork.

gen.WriteVersionedGoFile writes tables.go into the package directory. This is a standard Go code generation pattern, but any automated modification of source files outside the expected build outputs should be reviewed.