[go] net/url: avoid quadratic complexity in resolvePath
1 view
Skip to first unread message
Ian Alexander (Gerrit)
Jul 29, 2026, 12:47:37 PM (12 days ago) Jul 29
to goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Neal Patel, Neal Patel, golang...@luci-project-accounts.iam.gserviceaccount.com, golang-co...@googlegroups.com
Ian Alexander submitted the change![]( "Open in Gerrit")
Change information
Commit message:
net/url: avoid quadratic complexity in resolvePath
Operate on a []byte with index-based backtracking instead of calling
dst.String() and dst.WriteString() per iteration.
goos: linux
goarch: amd64
pkg: net/url
cpu: AMD EPYC 7B13
│ b/gotip │ b/fixed │
│ sec/op │ sec/op vs base │
ResolvePath/Simple 123.85n ± 1% 94.56n ± 0% -23.65% (p=0.000 n=10)
ResolvePath/Deep 1.819µ ± 1% 1.611µ ± 1% -11.41% (p=0.000 n=10)
ResolvePath/Backtrack 6.439µ ± 2% 2.280µ ± 1% -64.59% (p=0.000 n=10)
geomean 1.132µ 702.9n -37.90%
│ b/gotip │ b/fixed │
│ B/op │ B/op vs base │
ResolvePath/Simple 16.000 ± 0% 4.000 ± 0% -75.00% (p=0.000 n=10)
ResolvePath/Deep 712.0 ± 0% 624.0 ± 0% -12.36% (p=0.000 n=10)
ResolvePath/Backtrack 9064.0 ± 0% 816.0 ± 0% -91.00% (p=0.000 n=10)
geomean 469.1 126.8 -72.98%
│ b/gotip │ b/fixed │
│ allocs/op │ allocs/op vs base │
ResolvePath/Simple 2.000 ± 0% 1.000 ± 0% -50.00% (p=0.000 n=10)
ResolvePath/Deep 7.000 ± 0% 3.000 ± 0% -57.14% (p=0.000 n=10)
ResolvePath/Backtrack 107.000 ± 0% 3.000 ± 0% -97.20% (p=0.000 n=10)
geomean 11.44 2.080 -81.82%
Fixes #80494
Fixes CVE-2026-56860
Change-Id: I0aada41a0a10e2ce77c6476a65a49abc796dff3f
Reviewed-on: https://go-review.googlesource.com/c/go/+/803681
Reviewed-by: Neal Patel <neal...@google.com>
LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>
Files:
- M src/net/url/url.go
- M src/net/url/url_test.go
Change size: M
Delta: 2 files changed, 40 insertions(+), 33 deletions(-)
Branch: refs/heads/master
Submit Requirements:
Code-Review: +2 by Neal Patel
TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Mark Freeman (Gerrit)
Aug 5, 2026, 4:24:53 PM (5 days ago) Aug 5
to Ian Alexander, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Neal Patel, golang...@luci-project-accounts.iam.gserviceaccount.com, Damien Neil, Nicholas Husin, Gopher Robot, golang-co...@googlegroups.com
Mark Freeman submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[release-branch.go1.27] net/url: avoid quadratic complexity in resolvePath
Operate on a []byte with index-based backtracking instead of calling
dst.String() and dst.WriteString() per iteration.
goos: linux
goarch: amd64
pkg: net/url
cpu: AMD EPYC 7B13
│ b/gotip │ b/fixed │
│ sec/op │ sec/op vs base │
ResolvePath/Simple 123.85n ± 1% 94.56n ± 0% -23.65% (p=0.000 n=10)
ResolvePath/Deep 1.819µ ± 1% 1.611µ ± 1% -11.41% (p=0.000 n=10)
ResolvePath/Backtrack 6.439µ ± 2% 2.280µ ± 1% -64.59% (p=0.000 n=10)
geomean 1.132µ 702.9n -37.90%
│ b/gotip │ b/fixed │
│ B/op │ B/op vs base │
ResolvePath/Simple 16.000 ± 0% 4.000 ± 0% -75.00% (p=0.000 n=10)
ResolvePath/Deep 712.0 ± 0% 624.0 ± 0% -12.36% (p=0.000 n=10)
ResolvePath/Backtrack 9064.0 ± 0% 816.0 ± 0% -91.00% (p=0.000 n=10)
geomean 469.1 126.8 -72.98%
│ b/gotip │ b/fixed │
│ allocs/op │ allocs/op vs base │
ResolvePath/Simple 2.000 ± 0% 1.000 ± 0% -50.00% (p=0.000 n=10)
ResolvePath/Deep 7.000 ± 0% 3.000 ± 0% -57.14% (p=0.000 n=10)
ResolvePath/Backtrack 107.000 ± 0% 3.000 ± 0% -97.20% (p=0.000 n=10)
geomean 11.44 2.080 -81.82%
Updates #80494
Fixes CVE-2026-56860
Change-Id: I0aada41a0a10e2ce77c6476a65a49abc796dff3f
Reviewed-on: https://go-review.googlesource.com/c/go/+/803681
Reviewed-by: Neal Patel <neal...@google.com>
LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>
(cherry picked from commit 594b58aa32c4a5535c1ae8ab6e4387418316f950)
Reviewed-on: https://go-review.googlesource.com/c/go/+/807700
Auto-Submit: Ian Alexander <ji...@google.com>
Commit-Queue: Mark Freeman <markf...@google.com>
Files:
- M src/net/url/url.go
- M src/net/url/url_test.go
Change size: M
Delta: 2 files changed, 40 insertions(+), 33 deletions(-)
Branch: refs/heads/release-branch.go1.27
Submit Requirements:
Code-Review: +2 by Neal Patel
TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Mark Freeman (Gerrit)
Aug 5, 2026, 4:54:35 PM (5 days ago) Aug 5
to Ian Alexander, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, golang...@luci-project-accounts.iam.gserviceaccount.com, Carlos Amedee, Neal Patel, Nicholas Husin, Damien Neil, Gopher Robot, golang-co...@googlegroups.com
Mark Freeman submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[release-branch.go1.25] net/url: avoid quadratic complexity in resolvePath
Fixes #80629
Fixes CVE-2026-56860
Change-Id: I0aada41a0a10e2ce77c6476a65a49abc796dff3f
Reviewed-on: https://go-review.googlesource.com/c/go/+/803681
Reviewed-by: Neal Patel <neal...@google.com>
LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>
(cherry picked from commit 594b58aa32c4a5535c1ae8ab6e4387418316f950)
Reviewed-on: https://go-review.googlesource.com/c/go/+/807560
Reviewed-by: Carlos Amedee <car...@golang.org>
Files:
- M src/net/url/url.go
- M src/net/url/url_test.go
Change size: M
Delta: 2 files changed, 40 insertions(+), 33 deletions(-)
Branch: refs/heads/release-branch.go1.25
Submit Requirements:
Code-Review: +2 by Neal Patel, +1 by Carlos Amedee
TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Mark Freeman (Gerrit)
Aug 5, 2026, 5:04:16 PM (5 days ago) Aug 5
to Ian Alexander, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, golang...@luci-project-accounts.iam.gserviceaccount.com, Carlos Amedee, Neal Patel, Damien Neil, Nicholas Husin, Gopher Robot, golang-co...@googlegroups.com
Mark Freeman submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[release-branch.go1.26] net/url: avoid quadratic complexity in resolvePath
Fixes #80630
Fixes CVE-2026-56860
Change-Id: I0aada41a0a10e2ce77c6476a65a49abc796dff3f
Reviewed-on: https://go-review.googlesource.com/c/go/+/803681
Reviewed-by: Neal Patel <neal...@google.com>
LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>
(cherry picked from commit 594b58aa32c4a5535c1ae8ab6e4387418316f950)
Reviewed-on: https://go-review.googlesource.com/c/go/+/806962
Reviewed-by: Carlos Amedee <car...@golang.org>
Files:
- M src/net/url/url.go
- M src/net/url/url_test.go
Change size: M
Delta: 2 files changed, 40 insertions(+), 33 deletions(-)
Branch: refs/heads/release-branch.go1.26
Submit Requirements:
Code-Review: +2 by Neal Patel, +1 by Carlos Amedee
TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Reply all
Reply to author
Forward
0 new messages