1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
// Copyright 2021 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package vulncheck
import (
"runtime"
"sort"
"golang.org/x/vuln/internal/client"
"golang.org/x/vuln/internal/osv"
"golang.org/x/vuln/internal/semver"
)
// newTestClient returns a client that reads
// a database with the following vulnerable symbols:
//
// golang.org/amod/avuln.{VulnData.Vuln1, vulnData.Vuln2}
// golang.org/bmod/bvuln.Vuln
// archive/zip.OpenReader
func newTestClient() (*client.Client, error) {
return client.NewInMemoryClient(
[]*osv.Entry{
{
ID: "VA",
Affected: []osv.Affected{{
Module: osv.Module{Path: "golang.org/amod"},
Ranges: []osv.Range{{Type: osv.RangeTypeSemver, Events: []osv.RangeEvent{{Introduced: "1.0.0"}, {Fixed: "1.0.4"}, {Introduced: "1.1.2"}}}},
EcosystemSpecific: osv.EcosystemSpecific{Packages: []osv.Package{{
Path: "golang.org/amod/avuln",
Symbols: []string{"VulnData.Vuln1", "VulnData.Vuln2"}},
}},
}},
},
{
ID: "VB",
Affected: []osv.Affected{{
Module: osv.Module{Path: "golang.org/bmod"},
Ranges: []osv.Range{{Type: osv.RangeTypeSemver}},
EcosystemSpecific: osv.EcosystemSpecific{
Packages: []osv.Package{{
Path: "golang.org/bmod/bvuln",
Symbols: []string{"Vuln"},
}},
},
}},
},
{
ID: "STD",
Affected: []osv.Affected{{
Module: osv.Module{Path: osv.GoStdModulePath},
// Range is populated also using runtime info for testing binaries since
// setting fixed Go version for binaries is very difficult.
Ranges: []osv.Range{{Type: osv.RangeTypeSemver, Events: []osv.RangeEvent{{Introduced: "1.18"}, {Introduced: semver.GoTagToSemver(runtime.Version())}}}},
EcosystemSpecific: osv.EcosystemSpecific{
Packages: []osv.Package{{
Path: "archive/zip",
Symbols: []string{"OpenReader"},
}},
},
}},
}})
}
type edge struct {
// src and dest are ids of source and
// destination nodes in a callgraph edge.
src, dst string
}
func callGraphToStrMap(r *Result) map[string][]string {
// seen edges, to avoid repetitions
seen := make(map[edge]bool)
m := make(map[string][]string)
for _, v := range r.Vulns {
updateCallGraph(m, v.CallSink, seen)
}
sortStrMap(m)
return m
}
func updateCallGraph(callGraph map[string][]string, f *FuncNode, seen map[edge]bool) {
fName := f.String()
for _, callsite := range f.CallSites {
e := edge{src: callsite.Parent.Name, dst: f.Name}
if seen[e] {
continue
}
seen[e] = true
callerName := callsite.Parent.String()
callGraph[callerName] = append(callGraph[callerName], fName)
updateCallGraph(callGraph, callsite.Parent, seen)
}
}
// sortStrMap sorts the map string slice values to make them deterministic.
func sortStrMap(m map[string][]string) {
for _, strs := range m {
sort.Strings(strs)
}
}
|
