{"action":"created","issue":{"url":"https://api.github.com/repos/golang/go/issues/14959","repository_url":"https://api.github.com/repos/golang/go","labels_url":"https://api.github.com/repos/golang/go/issues/14959/labels{/name}","comments_url":"https://api.github.com/repos/golang/go/issues/14959/comments","events_url":"https://api.github.com/repos/golang/go/issues/14959/events","html_url":"https://github.com/golang/go/issues/14959","id":143438939,"number":14959,"title":"syscall: guard against Windows DLL preloading attacks  ","user":{"login":"bradfitz","id":2621,"avatar_url":"https://avatars.githubusercontent.com/u/2621?v=3","gravatar_id":"","url":"https://api.github.com/users/bradfitz","html_url":"https://github.com/bradfitz","followers_url":"https://api.github.com/users/bradfitz/followers","following_url":"https://api.github.com/users/bradfitz/following{/other_user}","gists_url":"https://api.github.com/users/bradfitz/gists{/gist_id}","starred_url":"https://api.github.com/users/bradfitz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradfitz/subscriptions","organizations_url":"https://api.github.com/users/bradfitz/orgs","repos_url":"https://api.github.com/users/bradfitz/repos","events_url":"https://api.github.com/users/bradfitz/events{/privacy}","received_events_url":"https://api.github.com/users/bradfitz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/golang/go/labels/Security","name":"Security","color":"ededed"}],"state":"open","locked":false,"assignee":{"login":"bradfitz","id":2621,"avatar_url":"https://avatars.githubusercontent.com/u/2621?v=3","gravatar_id":"","url":"https://api.github.com/users/bradfitz","html_url":"https://github.com/bradfitz","followers_url":"https://api.github.com/users/bradfitz/followers","following_url":"https://api.github.com/users/bradfitz/following{/other_user}","gists_url":"https://api.github.com/users/bradfitz/gists{/gist_id}","starred_url":"https://api.github.com/users/bradfitz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradfitz/subscriptions","organizations_url":"https://api.github.com/users/bradfitz/orgs","repos_url":"https://api.github.com/users/bradfitz/repos","events_url":"https://api.github.com/users/bradfitz/events{/privacy}","received_events_url":"https://api.github.com/users/bradfitz/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/golang/go/milestones/36","html_url":"https://github.com/golang/go/milestones/Go1.6.1","labels_url":"https://api.github.com/repos/golang/go/milestones/36/labels","id":1589951,"number":36,"title":"Go1.6.1","description":"","creator":{"login":"ianlancetaylor","id":3194333,"avatar_url":"https://avatars.githubusercontent.com/u/3194333?v=3","gravatar_id":"","url":"https://api.github.com/users/ianlancetaylor","html_url":"https://github.com/ianlancetaylor","followers_url":"https://api.github.com/users/ianlancetaylor/followers","following_url":"https://api.github.com/users/ianlancetaylor/following{/other_user}","gists_url":"https://api.github.com/users/ianlancetaylor/gists{/gist_id}","starred_url":"https://api.github.com/users/ianlancetaylor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ianlancetaylor/subscriptions","organizations_url":"https://api.github.com/users/ianlancetaylor/orgs","repos_url":"https://api.github.com/users/ianlancetaylor/repos","events_url":"https://api.github.com/users/ianlancetaylor/events{/privacy}","received_events_url":"https://api.github.com/users/ianlancetaylor/received_events","type":"User","site_admin":false},"open_issues":9,"closed_issues":17,"state":"open","created_at":"2016-02-18T03:45:44Z","updated_at":"2016-03-28T20:55:24Z","due_on":"2016-03-17T07:00:00Z","closed_at":null},"comments":18,"created_at":"2016-03-25T06:40:00Z","updated_at":"2016-03-29T02:55:02Z","closed_at":null,"body":"Taru Karttunen noted that Go should be more paranoid by default when loading DLLs.\r\n\r\nBackground:\r\nhttps://textplain.wordpress.com/2015/12/18/dll-hijacking-just-wont-die/\r\n\r\nMicrosoft's guidelines:\r\nhttps://msdn.microsoft.com/en-us/library/ff919712%28VS.85%29.aspx\r\n\r\nLoadLibraryEx docs:\r\nhttps://msdn.microsoft.com/en-us/library/ms684179(v=vs.85).aspx\r\n\r\n@rsc proposed:\r\n\r\n> 1) Change syscall.LoadDLL to call LoadLibraryEx with flags=LOAD_LIBRARY_SEARCH_SYSTEM32 instead of calling LoadLibrary. That is, LoadDLL is now secure by default and cannot load DLLs from the directory containing the executable.\r\n> 2) Add a LoadLibraryEx to x/sys/win so that users can still get at the old behavior if they want it (by appropriate passing of flags).\r\n\r\nCL forthcoming.\r\n\r\n/cc @alexbrainman @adg @broady @jbuberel @ianlancetaylor "},"comment":{"url":"https://api.github.com/repos/golang/go/issues/comments/202680815","html_url":"https://github.com/golang/go/issues/14959#issuecomment-202680815","issue_url":"https://api.github.com/repos/golang/go/issues/14959","id":202680815,"user":{"login":"bradfitz","id":2621,"avatar_url":"https://avatars.githubusercontent.com/u/2621?v=3","gravatar_id":"","url":"https://api.github.com/users/bradfitz","html_url":"https://github.com/bradfitz","followers_url":"https://api.github.com/users/bradfitz/followers","following_url":"https://api.github.com/users/bradfitz/following{/other_user}","gists_url":"https://api.github.com/users/bradfitz/gists{/gist_id}","starred_url":"https://api.github.com/users/bradfitz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradfitz/subscriptions","organizations_url":"https://api.github.com/users/bradfitz/orgs","repos_url":"https://api.github.com/users/bradfitz/repos","events_url":"https://api.github.com/users/bradfitz/events{/privacy}","received_events_url":"https://api.github.com/users/bradfitz/received_events","type":"User","site_admin":false},"created_at":"2016-03-29T02:55:02Z","updated_at":"2016-03-29T02:55:02Z","body":"I've updated https://go-review.googlesource.com/21140 to hopefully be non-controversial. It now makes sure that all DLLs loaded by Go itself are safe, but does nothing to protect users using `syscall.LoadLibrary` or `syscall.NewLazyDLL` themselves.\r\n"}}