From da5ecd81bda1611c4dea327ed26e2e79cea7b125 Mon Sep 17 00:00:00 2001
From: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Date: Tue, 3 Nov 2026 08:40:54 -0800
Subject: [PATCH] fix(audit): keep trimpath rewrites and directory fields apart
 from selectors

---
 .../releaseExposure/ReleaseExposureService.test.ts  | 13 +++++++++++++
 .../releaseExposure/ReleaseExposureService.ts       | 10 +++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/src/application/releaseExposure/ReleaseExposureService.test.ts b/src/application/releaseExposure/ReleaseExposureService.test.ts
index 473a949e1e..0b9d426c43 100644
--- a/src/application/releaseExposure/ReleaseExposureService.test.ts
+++ b/src/application/releaseExposure/ReleaseExposureService.test.ts
@@ -1444,6 +1444,7 @@ describe("ReleaseExposureService Go rooted linker flag paths", () => {
     [`-L=/tmp/private,sdk -s -w`, "/tmp/private,sdk"],
     [`all=-L=/tmp/private,sdk`, "/tmp/private,sdk"],
     [`-tmpdir /srv/obj,1`, "/srv/obj,1"],
+    [`-L "/tmp/private=-sdk"`, "/tmp/private=-sdk"],
   ])("keeps the whole rooted argument in %s", async (value, path) => {
     const report = await goReport(goModule([{ key: "-ldflags", value }]));
     const check = report.checks.find((item) => item.id === "go.build_paths");
@@ -1452,6 +1453,18 @@ describe("ReleaseExposureService Go rooted linker flag paths", () => {
   });
 });
 
+describe("ReleaseExposureService Go trimpath rewrites", () => {
+  it("keeps the rooted half of a relative -trimpath rewrite", async () => {
+    const report = await goReport(
+      goModule([{ key: "-gcflags", value: "-trimpath=src=/srv/build" }]),
+    );
+    const check = report.checks.find((item) => item.id === "go.build_paths");
+    expect(check?.observation.samples).toEqual(
+      expect.arrayContaining(["/srv/build"]),
+    );
+  });
+});
+
 describe("ReleaseExposureService Go relative flag paths", () => {
   it("keeps relative paths given to compiler path flags, attached or not", async () => {
     const report = await goReport(
diff --git a/src/application/releaseExposure/ReleaseExposureService.ts b/src/application/releaseExposure/ReleaseExposureService.ts
index d3450990d1..da8478f058 100644
--- a/src/application/releaseExposure/ReleaseExposureService.ts
+++ b/src/application/releaseExposure/ReleaseExposureService.ts
@@ -983,9 +983,11 @@ const goToolFlagPaths = (
       attached.length === 0 && next !== undefined && !next.startsWith("-");
     const argument = fromNext ? next : attached;
     if (argument.length === 0) continue;
-    if (GO_PATH_LIST_FLAG.test(flag) && filesystemPath(argument) !== null)
-      continue;
+    const list = GO_PATH_LIST_FLAG.test(flag);
+    if (list && filesystemPath(argument) !== null) continue;
     paths.push(argument);
+    // A rewrite list's rooted parts are still read by `flagPaths`.
+    if (list) continue;
     fields.add(flag);
     if (fromNext) fields.add(next);
   }
@@ -1032,7 +1034,9 @@ const goSettingPaths = (key: string, value: string): string[] => {
   return [
     ...flagPaths(
       own.filter(
-        (field) => !whole.fields.has(field.replace(GO_PACKAGE_SELECTOR, "")),
+        (field) =>
+          !whole.fields.has(field) &&
+          !whole.fields.has(field.replace(GO_PACKAGE_SELECTOR, "")),
       ),
     ),
     ...whole.paths,