task: check the lexical restrictions on gno module paths and compare to go

[kristovatlas]

Description

https://go.dev/ref/mod#go-mod-file-ident

[zivkovicmilos]

@kristovatlas any chance we can get this rolling in the next few days?

[kristovatlas]

Ok so the lexical restrictions on gno.mod aren't documented anywhere I can find, but the code is fairly copy/pasted over from Go. Because of the complexity of the code, I don't think I'll tease out the differences with additional manual review, so my next step will be to write a little fuzzer that mutates a sample file and runs them through go mod and gno mod looking for discrepancies.

[kristovatlas]

The relevant files:

https://github.com/golang/mod/blob/master/modfile/read.go parses the file into AST
https://github.com/golang/mod/blob/master/modfile/rule.go does more parsing related stuff and verifies the syntax rules

https://github.com/gnolang/gno/blob/master/gnovm/pkg/gnomod/read.go combines functions from both of these

[kristovatlas]

Working on a simple fuzzing tool revealed the following issue: #3493

[kristovatlas]

This is the fuzzing tool: https://github.com/kristovatlas/gno-fuzz-comparer

[thehowl]

Why is this "security" and "mainnet beta launch" when gno.mod files are not even used or published on-chain?

[moul]

It should not be labeled as "mainnet beta launch." Although it may be difficult to identify a scenario where this poses a security concern, it can indeed be one. I would categorize it as "low-impact security," which is not among our current priorities.

[kristovatlas]

Bumped milestone to post-mainnet.