hoelee/cloudflared
1
0
Fork 0
mirror of https://github.com/cloudflare/cloudflared.git synced 2026-05-14 19:40:41 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

TUN-10216: TUN fix cloudflare vulnerabilities GO-2026-4340 and GO-2026-4341

Browse Source 
* TUN-10216: TUN fix cloudflare vulnerabilities GO-2026-4340 and GO-2026-4341

Closes TUN-10216
This commit is contained in:
Luis Neto
2026-02-06 10:01:07 +00:00
parent d7c62aed71
commit d6cb78aeb4
10 changed files with 66 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ci/scripts/mac/install-go.sh
+6 -2
View File
@@ -2,9 +2,13 @@ rm -rf /tmp/go
export GOCACHE=/tmp/gocache
rm -rf $GOCACHE
brew install [email protected]
if [ -z "$1" ]
then
echo "No go version supplied"
fi
brew install "$1"
go version
which go
go env
.ci/scripts/vuln-check.sh
+15 -14
View File
@@ -4,13 +4,14 @@ set -e -u
# Define the file to store the list of vulnerabilities to ignore.
IGNORE_FILE=".vulnignore"
go version
# Check if the ignored vulnerabilities file exists. If not, create an empty one.
if [ ! -f "$IGNORE_FILE" ]; then
touch "$IGNORE_FILE"
echo "Created an empty file to store ignored vulnerabilities: $IGNORE_FILE"
echo "# Add vulnerability IDs (e.g., GO-2022-0450) to ignore, one per line." >> "$IGNORE_FILE"
echo "# You can also add comments on the same line after the ID." >> "$IGNORE_FILE"
echo "" >> "$IGNORE_FILE"
touch "$IGNORE_FILE"
echo "Created an empty file to store ignored vulnerabilities: $IGNORE_FILE"
echo "# Add vulnerability IDs (e.g., GO-2022-0450) to ignore, one per line." >>"$IGNORE_FILE"
echo "# You can also add comments on the same line after the ID." >>"$IGNORE_FILE"
echo "" >>"$IGNORE_FILE"
fi
# Run govulncheck and capture its output.
@@ -35,18 +36,18 @@ UNIGNORED_VULNS=$(echo "$VULN_OUTPUT" | grep 'Vulnerability')
# If the list of ignored vulnerabilities is not empty, filter them out.
if [ -n "$CLEAN_IGNORES" ]; then
UNIGNORED_VULNS=$(echo "$UNIGNORED_VULNS" | grep -vFf <(echo "$CLEAN_IGNORES") || true)
UNIGNORED_VULNS=$(echo "$UNIGNORED_VULNS" | grep -vFf <(echo "$CLEAN_IGNORES") || true)
fi
# If there are any vulnerabilities that were not in our ignore list, print them and exit with an error.
if [ -n "$UNIGNORED_VULNS" ]; then
echo "🚨 Found new, unignored vulnerabilities:"
echo "-------------------------------------"
echo "$UNIGNORED_VULNS"
echo "-------------------------------------"
echo "Exiting with an error. ❌"
exit 1
echo "🚨 Found new, unignored vulnerabilities:"
echo "-------------------------------------"
echo "$UNIGNORED_VULNS"
echo "-------------------------------------"
echo "Exiting with an error. ❌"
exit 1
else
echo "🎉 No new vulnerabilities found. All clear! ✨"
exit 0
echo "🎉 No new vulnerabilities found. All clear! ✨"
exit 0
fi