CL 685755 added a new subtest TestLookPath/path=exe/dotdot1 which always fails on Plan 9 builders in this way:

--- FAIL: TestLookPath (0.43s)
    dot_test.go:42: . is `/tmp/TestLookPath3081099371/001/testdir`
--- FAIL: TestLookPath/path=exe (0.01s)
--- FAIL: TestLookPath/path=exe/dotdot1 (0.01s)
    dot_test.go:210: PATH=
    dot_test.go:210: "abc/..": error expected, got nil
    dot_test.go:210: "abc/..": path returned should be "". Got "/home/swarming/swarming2/.swarming/w/ir/x/t/go-build579210599/b1944/exec.test"
FAIL
FAIL    os/exec 11.258s

Since the CL is described as a security-related fix, it's disappointing to see that it was merged without checking that it worked correctly on all platforms (not just first-class ports).

Comment From: millerresearch

The test fails from a combination of two causes:

  • To look for an executable file in a directory on the path, filepath.Join is used to join the directory name and filename. But filepath.Join finishes with a call to filepath.Clean, which removes internal .. components and their predecessor components by a purely lexical check: for example badfile/abc/.. is transformed to badfile even if badfile/abc/ isn't a directory or doesn't exist.
  • The above applies on all platforms. However on most platforms it doesn't affect LookPath because the path search is bypassed for file strings containing a / anywhere. But the behaviour of LookPath on Plan 9 is different: the search is bypassed only when / is at the beginning of a file string. This is because on Plan 9 the /bin directory has many subdirectories, and so it's common to run commands such as usb/probe or auth/factotum or ip/ftpd and so on using /bin as the search path.

Comment From: gopherbot

Change https://go.dev/cl/693935 mentions this issue: os/exec: fix incorrect expansion of ".." in LookPath on plan9

Comment From: dmitshur

CC @dolmen, @neild, @golang/plan9.