vulntest

Documentation

Overview

Package vulntest provides helpers for vulncheck functionality testing.

Index

• func AffectedRanges(versions []VersionRange) []osv.Range
• type DB
  • func NewDatabase(ctx context.Context, txtarReports []byte) (*DB, error)
  • func (db *DB) Clean() error
  • func (db *DB) URI() string
• type Module
• type Package
• type Reference
  • func (r *Reference) MarshalYAML() (interface{}, error)
  • func (r *Reference) UnmarshalYAML(n *yaml.Node) (err error)
• type Report
  • func (r *Report) ToString() (string, error)
  • func (r *Report) Write(filename string) (err error)
• type Version
  • func (v Version) Before(v2 Version) bool
  • func (v Version) Canonical() string
  • func (v Version) IsValid() bool
  • func (v Version) V() string
• type VersionRange

Functions

func AffectedRanges

func AffectedRanges(versions []VersionRange) []osv.Range

Types

type DB

type DB struct {
	// contains filtered or unexported fields
}

DB is a read-only vulnerability database on disk. Users can use this database with golang.org/x/vuln APIs by setting the `VULNDB` environment variable.

func NewDatabase

func NewDatabase(ctx context.Context, txtarReports []byte) (*DB, error)

NewDatabase returns a read-only DB containing the provided txtar-format collection of vulnerability reports. Each vulnerability report is a YAML file whose format is defined in golang.org/x/vulndb/doc/format.md. A report file name must have the id as its base name, and have .yaml as its extension.

db, err := NewDatabase(ctx, reports)
...
defer db.Clean()
client, err := NewClient(db)
...

The returned DB's Clean method must be called to clean up the generated database.

func (*DB) Clean

func (db *DB) Clean() error

Clean deletes the database.

func (*DB) URI

func (db *DB) URI() string

URI returns the file URI that can be used for VULNDB environment variable.

type Module

type Module struct {
	Module   string         `yaml:",omitempty"`
	Versions []VersionRange `yaml:",omitempty"`
	Packages []*Package     `yaml:",omitempty"`
}

type Package

type Package struct {
	Package string   `yaml:",omitempty"`
	GOOS    []string `yaml:"goos,omitempty"`
	GOARCH  []string `yaml:"goarch,omitempty"`
	// Symbols originally identified as vulnerable.
	Symbols []string `yaml:",omitempty"`
	// Additional vulnerable symbols, computed from Symbols via static analysis
	// or other technique.
	DerivedSymbols []string `yaml:"derived_symbols,omitempty"`
}

type Reference

type Reference osv.Reference

A Reference is a link to some external resource.

For ease of typing, References are represented in the YAML as a single-element mapping of type to URL.

func (*Reference) MarshalYAML

func (r *Reference) MarshalYAML() (interface{}, error)

func (*Reference) UnmarshalYAML

func (r *Reference) UnmarshalYAML(n *yaml.Node) (err error)

type Report

type Report struct {
	ID string `yaml:",omitempty"`

	Modules []*Module `yaml:",omitempty"`

	// Summary is a short phrase describing the vulnerability.
	Summary string `yaml:",omitempty"`

	// Description is the CVE description from an existing CVE. If we are
	// assigning a CVE ID ourselves, use CVEMetadata.Description instead.
	Description string     `yaml:",omitempty"`
	Published   time.Time  `yaml:",omitempty"`
	Withdrawn   *time.Time `yaml:",omitempty"`

	References []*Reference `yaml:",omitempty"`
}

Report represents a vulnerability report in the vulndb. See https://go.googlesource.com/vulndb/+/refs/heads/master/doc/format.md

func (*Report) ToString

func (r *Report) ToString() (string, error)

ToString encodes r to a YAML string.

func (*Report) Write

func (r *Report) Write(filename string) (err error)

Write writes r to filename in YAML format.

type Version

type Version string

Version is a SemVer 2.0.0 semantic version with no leading "v" prefix, as used by OSV.

func (Version) Before

func (v Version) Before(v2 Version) bool

Before reports whether v < v2.

func (Version) Canonical

func (v Version) Canonical() string

Canonical returns the canonical formatting of the version.

func (Version) IsValid

func (v Version) IsValid() bool

IsValid reports whether v is a valid semantic version string.

func (Version) V

func (v Version) V() string

V returns the version with a "v" prefix.

type VersionRange

type VersionRange struct {
	Introduced Version `yaml:"introduced,omitempty"`
	Fixed      Version `yaml:"fixed,omitempty"`
}