goplay怎么了？

Question

What happened to goplay? I see a lot of earlier references to a utility that used to ship with go at /misc/goplay. However, it seems this has been removed in go1.3

The old version is still viewable on the source repo as late as go1.3beta2: go1.3beta2: misc/goplay/, and works if you install it locally. Poking around a bit, I find that it was removed at revision 2daa4d89e0d9 citing concerns about code execution.

The playground is great, but it doesn't seem like it is easy to run your own local instance that will work with all of the libraries you have on path, and for some libraries, svgo in particular, it seems very useful to have a utility like goplay. Is there some new utility that is meant to supplant it? Is there a canonical choice of third party utility to achieve the same effect?

Answer 1

The commit message for its removal seems fairly straight forward. Anyone who could connect to the goplay server can execute arbitrary code as the user.

By default it listens on localhost, which makes it vulnerable to attacks from other local users on the machine, but if you configure it to listen on another address it will allow remote code execution.

You cite the ability to make use of packages not available on the Go Playground as a benefit, but this is also why goplay is less secure: the set of packages available to the Playground was chosen in order to close off attack vectors.

The code is still available in the repository history, so you can download and compile it if you want, but it is not recommended. For local development, you could probably get a better experience by teaching your favourite text editor to run go run filename.go in response to a shortcut or button press.