Jia Tanning Go code
www.arp242.net
  • lobsters__ek@crustaceanson.theshelf.topM
    1·
    14 days ago

    One improvement here would be if the go compiler rejected unrecognized suffixes, i.e. made _test.go and _unix.go and such a whitelist, and compile errored for unrecognized suffixes, like those with look-alike unicode chars.

    As-is, adding new suffixes is arguably a breaking change since they weren’t rejected in the past, i.e. as happened to someone when _ios.go was added as a special build tag.

    I think it’s actually kinda unfortunate that go picked _ for the separator here since it’s really common to use it instead of spaces in filenames. Something like ‘foo.windows.go / foo.unix.go / foo.ios.go’ I feel like would have been easier to make a whitelist without getting in the way of people’s file-naming preferences.

    score 10 · canonical

  • lobsters__pnathan@crustaceanson.theshelf.topM
    1·
    14 days ago

    weirdly, this is a decent argument for ole 7-bit ascii filenames. If I had an interesting enough open source codebase, I’d probably have a CI filter that ran a pass over the filenames to enforce [A-Za-z0-9._-] or thereabouts…

    score 15 · canonical

    • lobsters__donio@crustaceanson.theshelf.topM
      1·
      14 days ago

      I’ve been sticking to this as much as possible, more or less following the default detox rules.

      For a systemwide scan I’ve been using this plocate command to find anything outside the printable ASCII range: LANG=C locate --regex '[^ -~]'

      score 2 · canonical

  • lobsters__mjl@crustaceanson.theshelf.topM
    1·
    14 days ago

    Nice find. I’m happy the editor I’m using (acme) makes these characters stand out. As developer, it’s nice to have x-ray vision on funny unicode business. The webmail client I’m using highlights switching between unicode scripts/blocks (originally to spot idn homoglyph attempts). I’m using the (small) JS code to do that highlighting in more of my projects. Has been helpful finding (often accidental) weird unicode whitespace characters.

    score 2 · canonical

      • lobsters__snej@crustaceanson.theshelf.topM
        1·
        14 days ago

        It’s not a filename suffix in the sense of an extension, it’s the part of the name before the extension. But the IMO kludgy part is that this doesn’t identify the language of the file but what build target it should be part of, I.e. the main executable or the tests. There are some other magic naming conventions that apply to Cgo IIRC.

        The nasty part shown here is that you can fake the name so it looks like it isn’t part of the main target even though it is. That’s kind of the reverse of normal: you can make a file that looks like it ends in “.py” but doesn’t, but as far as I know you can’t make one that doesn’t look like it but really does.

        score 7 · canonical

        • lobsters__weberc2@crustaceanson.theshelf.topM
          1·
          14 days ago

          Yes, I agree that this is a vulnerability that doesn’t exist in most other languages (although it does in at least some popular Python test runners like Pytest), I’m just pushing back a bit on the idea that Go is unique for using file suffixes. That said, there is no technical difference between an extension and a suffix except maybe on Windows. On *nix platforms (as far as I know) there’s nothing special about the . character).

          EDIT: I asked ChatGPT which other languages have test runners that use naming conventions to identify test code and it turns out there are quite a few of them:

          Many programming languages rely on file naming conventions to identify test files. Here are some popular examples:

          1. JavaScript / TypeScript: Test runners like Jest, Mocha, and Jasmine look for files with names like *.test.js, *.spec.js, *.test.ts, or *.spec.ts by default.
          2. Python: unittest, pytest, and nose recognize files with names prefixed or suffixed with test (e.g., test_*.py or *_test.py).
          3. Go: The Go testing tool identifies test files by their _test.go suffix.
          4. Ruby: The RSpec framework usually looks for files ending in spec.rb, while minitest may use files named with test*.rb.
          5. Java: Testing frameworks like JUnit don’t require file naming conventions by default, but Maven and Gradle projects often organize tests in src/test/java with file names matching *Test.java or *Tests.java.
          6. PHP: PHPUnit often follows naming conventions like *Test.php to distinguish test files, though this can be customized.
          7. Elixir: ExUnit identifies test files by their _test.exs suffix.

          Many of these test runners allow customization but often follow these conventions as a default to simplify configuration.

          score 0 · canonical