-
Notifications
You must be signed in to change notification settings - Fork 371
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
An initial attempt at integrating govulncheck's library with OSV-Scanner. TODOs before full PR: ~~- [ ] Add config options after design doc is finalized~~ ~~- [ ] Allow user to configure tags and go versions~~ - [x] Update table output for inactive/not called vulnerabilities - [x] Update exit code for not called vulnerabilities - [x] Update README with feature and the go dependency if they want the vulncheck feature - [x] Add go as dependency into osv-scanner docker containers.
- Loading branch information
1 parent
5c4a365
commit 09e781b
Showing
35 changed files
with
3,298 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| fixtures |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| package govulncheckshim | ||
|
|
||
| import ( | ||
| "context" | ||
| "encoding/json" | ||
| "fmt" | ||
| "time" | ||
|
|
||
| "golang.org/x/vuln/client" | ||
| gvcOSV "golang.org/x/vuln/osv" | ||
|
|
||
| "github.com/google/osv-scanner/pkg/models" | ||
| ) | ||
|
|
||
| type localSource struct { | ||
| vulnList []models.Vulnerability | ||
| vulnsByID map[string]*models.Vulnerability | ||
| vulnsByAlias map[string][]*models.Vulnerability | ||
| vulnsByModule map[string][]*models.Vulnerability | ||
| lastModifiedTime time.Time | ||
| client.Client | ||
| } | ||
|
|
||
| func newClient(vulns []models.Vulnerability) *localSource { | ||
| client := localSource{ | ||
| vulnList: vulns, | ||
| vulnsByID: make(map[string]*models.Vulnerability), | ||
| vulnsByAlias: make(map[string][]*models.Vulnerability), | ||
| vulnsByModule: make(map[string][]*models.Vulnerability), | ||
| lastModifiedTime: time.Unix(0, 0), | ||
| } | ||
| for idx := range vulns { | ||
| // Iterate on reference to avoid copying entire data structure | ||
| v := &client.vulnList[idx] | ||
| client.vulnsByID[v.ID] = v | ||
| for _, alias := range v.Aliases { | ||
| client.vulnsByAlias[alias] = append(client.vulnsByAlias[alias], v) | ||
| } | ||
| for _, affected := range v.Affected { | ||
| client.vulnsByModule[affected.Package.Name] = append(client.vulnsByModule[affected.Package.Name], v) | ||
| } | ||
| if client.lastModifiedTime.Before(v.Modified) { | ||
| client.lastModifiedTime = v.Modified | ||
| } | ||
| } | ||
|
|
||
| return &client | ||
| } | ||
|
|
||
| func convertToGvcOSV(osv models.Vulnerability) (gvcOSV.Entry, error) { | ||
| val, err := json.Marshal(osv) | ||
| if err != nil { | ||
| return gvcOSV.Entry{}, fmt.Errorf("failed to convert vuln to JSON: %w", err) | ||
| } | ||
| response := gvcOSV.Entry{} | ||
| err = json.Unmarshal(val, &response) | ||
| if err != nil { | ||
| return gvcOSV.Entry{}, fmt.Errorf("gvc format is no longer compatible with osv format: %w", err) | ||
| } | ||
|
|
||
| return response, nil | ||
| } | ||
|
|
||
| func (ls *localSource) GetByModule(ctx context.Context, modulePath string) ([]*gvcOSV.Entry, error) { | ||
| //nolint:prealloc // Need to be nil if none exists | ||
| var entries []*gvcOSV.Entry | ||
| for _, v := range ls.vulnsByModule[modulePath] { | ||
| res, err := convertToGvcOSV(*v) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| entries = append(entries, &res) | ||
| } | ||
|
|
||
| return entries, nil | ||
| } | ||
|
|
||
| func (ls *localSource) GetByID(ctx context.Context, id string) (*gvcOSV.Entry, error) { | ||
| entry, ok := ls.vulnsByID[id] | ||
| if !ok { | ||
| //nolint:nilnil // This follows govulncheck's client implementation | ||
| // See: https://github.com/golang/vuln/blob/master/client/client.go | ||
| return nil, nil | ||
| } | ||
| response, err := convertToGvcOSV(*entry) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return &response, nil | ||
| } | ||
|
|
||
| func (ls *localSource) GetByAlias(ctx context.Context, alias string) ([]*gvcOSV.Entry, error) { | ||
| //nolint:prealloc // Need to be nil if none exists | ||
| var entries []*gvcOSV.Entry | ||
|
|
||
| for _, v := range ls.vulnsByAlias[alias] { | ||
| res, err := convertToGvcOSV(*v) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| entries = append(entries, &res) | ||
| } | ||
|
|
||
| return entries, nil | ||
| } | ||
|
|
||
| func (ls *localSource) ListIDs(ctx context.Context) ([]string, error) { | ||
| //nolint:prealloc // Need to be nil if none exists | ||
| var ids []string | ||
| for i := range ls.vulnList { | ||
| ids = append(ids, ls.vulnList[i].ID) | ||
| } | ||
|
|
||
| return ids, nil | ||
| } | ||
|
|
||
| func (ls *localSource) LastModifiedTime(context.Context) (time.Time, error) { | ||
| // Assume that if anything changes, the index does. | ||
| return ls.lastModifiedTime, nil | ||
| } |
Oops, something went wrong.