ROOTPLOIT
Server: LiteSpeed
System: Linux in-mum-web1878.main-hosting.eu 5.14.0-570.21.1.el9_6.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Jun 11 07:22:35 EDT 2025 x86_64
User: u435929562 (435929562)
PHP: 7.4.33
Disabled: system, exec, shell_exec, passthru, mysql_list_dbs, ini_alter, dl, symlink, link, chgrp, leak, popen, apache_child_terminate, virtual, mb_send_mail
Upload Files
File: //opt/golang/1.22.0/src/cmd/go/testdata/script/mod_get_ambiguous_pkg.txt
# Both example.net/ambiguous v0.1.0 and example.net/ambiguous/pkg v0.1.0 exist.
# 'go mod tidy' would arbitrarily choose the one with the longer path,
# but 'go mod tidy' also arbitrarily chooses the latest version.

cp go.mod go.mod.orig


# From a clean slate, 'go get' currently does the same thing as 'go mod tidy':
# it resolves the package from the module with the longest matching prefix.

go get example.net/ambiguous/nested/[email protected]
go list -m all
stdout '^example.net/ambiguous/nested v0.1.0$'
! stdout '^example.net/ambiguous '


# From an initial state that already depends on the shorter path,
# the same 'go get' command should (somewhat arbitrarily) keep the
# existing path, since it is a valid interpretation of the command.

cp go.mod.orig go.mod
go mod edit -require=example.net/[email protected]

go get example.net/ambiguous/nested/[email protected]
go list -m all
stdout '^example.net/ambiguous v0.1.0$'
! stdout '^example.net/ambiguous/nested '


# The user should be able to make the command unambiguous by explicitly
# upgrading the conflicting module...

go get example.net/[email protected] example.net/ambiguous/nested/[email protected]
go list -m all
stdout '^example.net/ambiguous/nested v0.1.0$'
stdout '^example.net/ambiguous v0.2.0$'


# ...or by explicitly NOT adding the conflicting module.

cp go.mod.orig go.mod
go mod edit -require=example.net/[email protected]

go get example.net/ambiguous/nested/[email protected] example.net/ambiguous/nested@none
go list -m all
! stdout '^example.net/ambiguous/nested '
stdout '^example.net/ambiguous v0.1.0$'


# The user should also be able to fix it by *downgrading* the conflicting module
# away.

cp go.mod.orig go.mod
go mod edit -require=example.net/[email protected]

go get example.net/ambiguous@none example.net/ambiguous/nested/[email protected]
go list -m all
stdout '^example.net/ambiguous/nested v0.1.0$'
! stdout '^example.net/ambiguous '


# In contrast, if we do the same thing tacking a wildcard pattern ('/...') on
# the end of the package path, we get different behaviors depending on the
# initial state, and no error. (This seems to contradict the “same meaning
# regardless of the initial state” point above, but maybe that's ok?)

cp go.mod.orig go.mod

go get example.net/ambiguous/nested/pkg/[email protected]
go list -m all
stdout '^example.net/ambiguous/nested v0.1.0$'
! stdout '^example.net/ambiguous '


cp go.mod.orig go.mod
go mod edit -require=example.net/[email protected]

go get example.net/ambiguous/nested/pkg/[email protected]
go list -m all
! stdout '^example.net/ambiguous/nested '
stdout '^example.net/ambiguous v0.1.0$'


-- go.mod --
module test

go 1.16