1 # When the sumdb returns a response which does not
2 # include a sum for the requested module,
3 # we should report an error.
4 # Verifies CVE-2026-42501.
5 env sumdb=$GOSUMDB
6 env proxy=$GOPROXY
7 env GOPROXY GONOPROXY GOSUMDB GONOSUMDB
8
9 # /sumdb-redirect/ causes the sumdb to return /lookup/ responses
10 # for rsc.io/quote@v1.0.0, not for the requested module.
11 env GOSUMDB=$sumdb' '$proxy/sumdb-redirect/rsc.io/quote@v1.0.0:
12
13 ! go get rsc.io/fortune@v1.0.0
14 stderr 'SECURITY ERROR'
15 ! grep rsc.io go.sum
16 -- go.mod --
17 module m
18
View as plain text