Yes, I agree that this is a vulnerability that doesn’t exist in most other languages (although it does in at least some popular Python test runners like Pytest), I’m just pushing back a bit on the idea that Go is unique for using file suffixes. That said, there is no technical difference between an extension and a suffix except maybe on Windows. On *nix platforms (as far as I know) there’s nothing special about the . character).

EDIT: I asked ChatGPT which other languages have test runners that use naming conventions to identify test code and it turns out there are quite a few of them:

Many programming languages rely on file naming conventions to identify test files. Here are some popular examples:

1. JavaScript / TypeScript: Test runners like Jest, Mocha, and Jasmine look for files with names like *.test.js, *.spec.js, *.test.ts, or *.spec.ts by default.
2. Python: unittest, pytest, and nose recognize files with names prefixed or suffixed with test (e.g., test_*.py or *_test.py).
3. Go: The Go testing tool identifies test files by their _test.go suffix.
4. Ruby: The RSpec framework usually looks for files ending in spec.rb, while minitest may use files named with test*.rb.
5. Java: Testing frameworks like JUnit don’t require file naming conventions by default, but Maven and Gradle projects often organize tests in src/test/java with file names matching *Test.java or *Tests.java.
6. PHP: PHPUnit often follows naming conventions like *Test.php to distinguish test files, though this can be customized.
7. Elixir: ExUnit identifies test files by their _test.exs suffix.

Many of these test runners allow customization but often follow these conventions as a default to simplify configuration.

score 0 · canonical