Skip to content

Commit ef1d7c0

Browse files
csuzhangxccsuzhangxc
authored
chore: bump some Go mods and binaries for security (#6515)
1 parent 84cca01 commit ef1d7c0

File tree

12 files changed

+281
-159
lines changed

12 files changed

+281
-159
lines changed

‎cmd/backup-manager/app/export/export.go‎

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,15 @@ package export
1616
import (
1717
"context"
1818
"fmt"
19+
"os"
1920
"os/exec"
2021
"path"
2122
"path/filepath"
2223
"strconv"
2324
"strings"
2425
"time"
2526

26-
"github.com/mholt/archiver/v3"
27+
"github.com/mholt/archives"
2728
"github.com/pingcap/tidb-operator/cmd/backup-manager/app/constants"
2829
backupUtil "github.com/pingcap/tidb-operator/cmd/backup-manager/app/util"
2930
"github.com/pingcap/tidb-operator/pkg/apis/pingcap/v1alpha1"
@@ -147,7 +148,7 @@ func getBackupSize(ctx context.Context, backupPath string, opts []string) (int64
147148
}
148149

149150
// archiveBackupData archive backup data by destFile's extension name.
150-
// NOTE: no context/timeout supported for `archiver.Archive`, this may cause to be KILLed when blocking.
151+
// NOTE: no context/timeout supported for archiving, this may cause to be KILLed when blocking.
151152
func archiveBackupData(backupDir, destFile string) error {
152153
if exist := backupUtil.IsDirExist(backupDir); !exist {
153154
return fmt.Errorf("dir %s does not exist or is not a dir", backupDir)
@@ -156,7 +157,33 @@ func archiveBackupData(backupDir, destFile string) error {
156157
if err := backupUtil.EnsureDirectoryExist(destDir); err != nil {
157158
return err
158159
}
159-
err := archiver.Archive([]string{backupDir}, destFile)
160+
161+
// Create output file
162+
outFile, err := os.Create(destFile)
163+
if err != nil {
164+
return fmt.Errorf("create archive file %s failed, err: %v", destFile, err)
165+
}
166+
defer outFile.Close()
167+
168+
// Create gzip writer
169+
gz := archives.Gz{}
170+
gzWriter, err := gz.OpenWriter(outFile)
171+
if err != nil {
172+
return fmt.Errorf("create gzip writer failed, err: %v", err)
173+
}
174+
defer gzWriter.Close()
175+
176+
// Get files to archive
177+
files, err := archives.FilesFromDisk(context.Background(), nil, map[string]string{
178+
backupDir: filepath.Base(backupDir),
179+
})
180+
if err != nil {
181+
return fmt.Errorf("get files from %s failed, err: %v", backupDir, err)
182+
}
183+
184+
// Create the tar archive into gzip writer
185+
tar := archives.Tar{}
186+
err = tar.Archive(context.Background(), gzWriter, files)
160187
if err != nil {
161188
return fmt.Errorf("archive backup data %s to %s failed, err: %v", backupDir, destFile, err)
162189
}

‎cmd/backup-manager/app/import/import.go‎

Lines changed: 50 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,13 @@ import (
1717
"context"
1818
"fmt"
1919
"io"
20+
"os"
2021
"os/exec"
2122
"path"
2223
"path/filepath"
2324
"strings"
2425

25-
"github.com/mholt/archiver/v3"
26+
"github.com/mholt/archives"
2627
"github.com/pingcap/tidb-operator/cmd/backup-manager/app/constants"
2728
backupUtil "github.com/pingcap/tidb-operator/cmd/backup-manager/app/util"
2829
"github.com/pingcap/tidb-operator/pkg/apis/pingcap/v1alpha1"
@@ -129,17 +130,60 @@ func (ro *Options) loadTidbClusterData(ctx context.Context, restorePath string,
129130
}
130131

131132
// unarchiveBackupData unarchive backup data to dest dir
132-
// NOTE: no context/timeout supported for `tarGz.Unarchive`, this may cause to be KILLed when blocking.
133+
// NOTE: no context/timeout supported for extraction, this may cause to be KILLed when blocking.
133134
func unarchiveBackupData(backupFile, destDir string) (string, error) {
134135
var unarchiveBackupPath string
135136
if err := backupUtil.EnsureDirectoryExist(destDir); err != nil {
136137
return unarchiveBackupPath, err
137138
}
138139
backupName := strings.TrimSuffix(filepath.Base(backupFile), constants.DefaultArchiveExtention)
139-
tarGz := archiver.NewTarGz()
140-
// overwrite if the file already exists
141-
tarGz.OverwriteExisting = true
142-
err := tarGz.Unarchive(backupFile, destDir)
140+
141+
// Open the archive file
142+
f, err := os.Open(backupFile)
143+
if err != nil {
144+
return unarchiveBackupPath, fmt.Errorf("failed to open backup file %s, err: %v", backupFile, err)
145+
}
146+
defer f.Close()
147+
148+
// First, decompress the gzip file
149+
gz := archives.Gz{}
150+
gzReader, err := gz.OpenReader(f)
151+
if err != nil {
152+
return unarchiveBackupPath, fmt.Errorf("failed to open gzip reader for %s, err: %v", backupFile, err)
153+
}
154+
defer gzReader.Close()
155+
156+
// Then extract the tar archive
157+
tar := archives.Tar{}
158+
err = tar.Extract(context.Background(), gzReader, func(ctx context.Context, fileInfo archives.FileInfo) error {
159+
targetPath := filepath.Join(destDir, fileInfo.NameInArchive)
160+
161+
if fileInfo.IsDir() {
162+
return backupUtil.EnsureDirectoryExist(targetPath)
163+
}
164+
165+
// Create parent directory if needed
166+
if err := backupUtil.EnsureDirectoryExist(filepath.Dir(targetPath)); err != nil {
167+
return err
168+
}
169+
170+
// Create and write the file
171+
outFile, err := os.Create(targetPath)
172+
if err != nil {
173+
return err
174+
}
175+
defer outFile.Close()
176+
177+
srcFile, err := fileInfo.Open()
178+
if err != nil {
179+
return err
180+
}
181+
defer srcFile.Close()
182+
183+
_, err = io.Copy(outFile, srcFile)
184+
return err
185+
})
186+
143187
if err != nil {
144188
return unarchiveBackupPath, fmt.Errorf("unarchive backup data %s to %s failed, err: %v", backupFile, destDir, err)
145189
}

‎cmd/http-service/go.mod‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/pingcap/tidb-operator/http-service
22

3-
go 1.23.2
3+
go 1.23.12
44

55
require (
66
github.com/gin-gonic/gin v1.10.0
@@ -40,7 +40,7 @@ require (
4040
github.com/gogo/protobuf v1.3.2 // indirect
4141
github.com/golang/protobuf v1.5.4 // indirect
4242
github.com/google/gnostic-models v0.6.8 // indirect
43-
github.com/google/go-cmp v0.6.0 // indirect
43+
github.com/google/go-cmp v0.7.0 // indirect
4444
github.com/google/gofuzz v1.2.0 // indirect
4545
github.com/google/uuid v1.6.0 // indirect
4646
github.com/grafana/regexp v0.0.0-20221122212121-6b5c0a4cb7fd // indirect
@@ -65,13 +65,13 @@ require (
6565
github.com/ugorji/go/codec v1.2.12 // indirect
6666
go.uber.org/multierr v1.11.0 // indirect
6767
golang.org/x/arch v0.8.0 // indirect
68-
golang.org/x/crypto v0.31.0 // indirect
68+
golang.org/x/crypto v0.41.0 // indirect
6969
golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb // indirect
70-
golang.org/x/net v0.33.0 // indirect
71-
golang.org/x/oauth2 v0.23.0 // indirect
72-
golang.org/x/sys v0.28.0 // indirect
73-
golang.org/x/term v0.27.0 // indirect
74-
golang.org/x/text v0.21.0 // indirect
70+
golang.org/x/net v0.43.0 // indirect
71+
golang.org/x/oauth2 v0.30.0 // indirect
72+
golang.org/x/sys v0.35.0 // indirect
73+
golang.org/x/term v0.34.0 // indirect
74+
golang.org/x/text v0.28.0 // indirect
7575
golang.org/x/time v0.5.0 // indirect
7676
google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 // indirect
7777
gopkg.in/inf.v0 v0.9.1 // indirect

‎cmd/http-service/go.sum‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,8 @@ github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6
5353
github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
5454
github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
5555
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
56-
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
57-
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
56+
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
57+
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
5858
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
5959
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
6060
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -165,8 +165,8 @@ golang.org/x/arch v0.8.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
165165
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
166166
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
167167
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
168-
golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
169-
golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
168+
golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
169+
golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
170170
golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb h1:c0vyKkb6yr3KR7jEfJaOSv4lG7xPkbN6r52aJz1d8a8=
171171
golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
172172
golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -177,10 +177,10 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
177177
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
178178
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
179179
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
180-
golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
181-
golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
182-
golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
183-
golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
180+
golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
181+
golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
182+
golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
183+
golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
184184
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
185185
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
186186
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -189,14 +189,14 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w
189189
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
190190
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
191191
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
192-
golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
193-
golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
194-
golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
195-
golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
192+
golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
193+
golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
194+
golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
195+
golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
196196
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
197197
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
198-
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
199-
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
198+
golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
199+
golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
200200
golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
201201
golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
202202
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -205,8 +205,8 @@ golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtn
205205
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
206206
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
207207
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
208-
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
209-
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
208+
golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
209+
golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
210210
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
211211
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
212212
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

0 commit comments

Comments
 (0)