1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
// Copyright 2021 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package vulncheck
import (
"context"
"fmt"
"golang.org/x/vuln/client"
"golang.org/x/vuln/internal"
)
var stdlibModule = &Module{
Path: internal.GoStdModulePath,
// Version is populated by Source and Binary based on user input
}
// modKey creates a unique string identifier for mod.
func modKey(mod *Module) string {
if mod == nil {
return ""
}
return fmt.Sprintf("%s@%s", mod.Path, mod.Version)
}
// extractModules collects modules in `pkgs` up to uniqueness of
// module path and version.
func extractModules(pkgs []*Package) []*Module {
modMap := map[string]*Module{}
// Add "stdlib" module. Even if stdlib is not used, which
// is unlikely, it won't appear in vulncheck.Modules nor
// other results.
modMap[stdlibModule.Path] = stdlibModule
seen := map[*Package]bool{}
var extract func(*Package, map[string]*Module)
extract = func(pkg *Package, modMap map[string]*Module) {
if pkg == nil || seen[pkg] {
return
}
if pkg.Module != nil {
if pkg.Module.Replace != nil {
modMap[modKey(pkg.Module.Replace)] = pkg.Module
} else {
modMap[modKey(pkg.Module)] = pkg.Module
}
}
seen[pkg] = true
for _, imp := range pkg.Imports {
extract(imp, modMap)
}
}
for _, pkg := range pkgs {
extract(pkg, modMap)
}
modules := []*Module{}
for _, mod := range modMap {
modules = append(modules, mod)
}
return modules
}
// fetchVulnerabilities fetches vulnerabilities that affect the supplied modules.
func fetchVulnerabilities(ctx context.Context, client client.Client, modules []*Module) (moduleVulnerabilities, error) {
mv := moduleVulnerabilities{}
for _, mod := range modules {
modPath := mod.Path
if mod.Replace != nil {
modPath = mod.Replace.Path
}
vulns, err := client.GetByModule(ctx, modPath)
if err != nil {
return nil, err
}
if len(vulns) == 0 {
continue
}
mv = append(mv, modVulns{
mod: mod,
vulns: vulns,
})
}
return mv, nil
}
|
