1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
// Copyright 2022 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package cache
import (
"context"
"os"
"golang.org/x/tools/gopls/internal/govulncheck"
"golang.org/x/tools/gopls/internal/lsp/source"
"golang.org/x/tools/gopls/internal/span"
"golang.org/x/tools/gopls/internal/vulncheck"
"golang.org/x/tools/internal/memoize"
)
// ModVuln returns import vulnerability analysis for the given go.mod URI.
// Concurrent requests are combined into a single command.
func (s *snapshot) ModVuln(ctx context.Context, modURI span.URI) (*govulncheck.Result, error) {
s.mu.Lock()
entry, hit := s.modVulnHandles.Get(modURI)
s.mu.Unlock()
type modVuln struct {
result *govulncheck.Result
err error
}
// Cache miss?
if !hit {
// If the file handle is an overlay, it may not be written to disk.
// The go.mod file has to be on disk for vulncheck to work.
//
// TODO(hyangah): use overlays for vulncheck.
fh, err := s.GetFile(ctx, modURI)
if err != nil {
return nil, err
}
if _, ok := fh.(*overlay); ok {
if info, _ := os.Stat(modURI.Filename()); info == nil {
return nil, source.ErrNoModOnDisk
}
}
handle := memoize.NewPromise("modVuln", func(ctx context.Context, arg interface{}) interface{} {
result, err := modVulnImpl(ctx, arg.(*snapshot), modURI)
return modVuln{result, err}
})
entry = handle
s.mu.Lock()
s.modVulnHandles.Set(modURI, entry, nil)
s.mu.Unlock()
}
// Await result.
v, err := s.awaitPromise(ctx, entry.(*memoize.Promise))
if err != nil {
return nil, err
}
res := v.(modVuln)
return res.result, res.err
}
func modVulnImpl(ctx context.Context, s *snapshot, uri span.URI) (*govulncheck.Result, error) {
if vulncheck.VulnerablePackages == nil {
return &govulncheck.Result{}, nil
}
fh, err := s.GetFile(ctx, uri)
if err != nil {
return nil, err
}
return vulncheck.VulnerablePackages(ctx, s, fh)
}
|
