sumdb: ignore unrelated hashes in Lookup

During Lookup, if the server returns a validly signed record for an
unrelated module which contains in the signed tree head another hash
for the module which was requested in the "extension" portion of the
signed tree head (anything following the tree hash, but before the
signatures), _only_ the unrelated hashes are validated by checking the
relevant tiles, ignoring the portion in the tree head.

Lookup would then look for hash lines which match the requested module
path in the fully returned record, not just the validated portion,
causing only the hash appended to the tree head portion to be returned.

This would allow a malicious sumdb instance to return a validly signed
response for a module from which Lookup would return a hash which is not
actually present in the tree. This would allow a conspiring malicious
sumdb and module proxy (or a module proxy which is proxying the sumdb
_and has the sumdb key_) to serve malicious module content which is not
recorded in the transparency log.

The fix is quite simple, instead of caching the full record, we only
cache the hash lines returned by tlog.ParseRecord, which are validated.
Lookup will then only extract matching hashes from the validated
portion, instead of the full record.

Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.

Fixes CVE-2026-56864
Fixes golang/go#80745

Change-Id: I4a418620e8e4e8ab5f7ec41b0ed443a92e9be6e1
Reviewed-on: https://go-review.googlesource.com/c/mod/+/815000
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Neal Patel <nealpatel@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

Author: rolandshoemaker

sumdb/client.go

@@ -274,7 +274,7 @@ func (c *Client) Lookup(path, vers string) (lines []string, err error) {
 			c.ops.WriteCache(file, data)
 		}
 
-		return cached{data, nil}
+		return cached{text, nil}
 	}).(cached)
 	if result.err != nil {
 		return nil, result.err

sumdb/client_test.go

@@ -189,6 +189,55 @@ func TestClientGONOSUMDB(t *testing.T) {
 	}
 }
 
+func TestRejectUnauthenticatedLines(t *testing.T) {
+	tc := newTestClient(t)
+
+	data := "golang.org/x/good v1.0.0 h1:7uVkIFmeBqHfdjD+gZwtXXI+RODJ2Wc4O7MPEh/QiW4=\n"
+	id := tc.treeSize
+	tc.treeSize++
+	rec, err := tlog.FormatRecord(id, []byte(data))
+	if err != nil {
+		t.Fatal(err)
+	}
+	hashes, err := tlog.StoredHashesForRecordHash(id, tlog.RecordHash([]byte(data)), tc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tc.hashes = append(tc.hashes, hashes...)
+
+	// Create lookup result.
+	h, err := tlog.TreeHash(tc.treeSize, tc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	text := append(tlog.FormatTree(tlog.Tree{N: tc.treeSize, Hash: h}), []byte("golang.org/x/bad v1.0.0 h1:7uVkIFmeBqHfdjD+gZwtXXI+RODJ2Wc4O7MPEh/QiW4=\n")...)
+	signed, err := note.Sign(&note.Note{Text: string(text)}, tc.signer)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	lookupRes := append(rec, signed...)
+	tc.remote["/lookup/golang.org/x/bad@v1.0.0"] = lookupRes
+
+	// Create new tiles.
+	tiles := tlog.NewTiles(tc.tileHeight, id, tc.treeSize)
+	for _, tile := range tiles {
+		data, err := tlog.ReadTileData(tile, tc)
+		if err != nil {
+			t.Fatal(err)
+		}
+		tc.remote["/"+tile.Path()] = data
+	}
+
+	lines, err := tc.client.Lookup("golang.org/x/bad", "v1.0.0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(lines) != 0 {
+		t.Errorf("Lookup(%q): expected no hashes, got %q", "golang.org/x/bad", strings.Join(lines, "\n"))
+	}
+}
+
 // A testClient is a self-contained client-side testing environment.
 type testClient struct {
 	t          *testing.T // active test