govulncheck

README

internal/govulncheck package

This package is a literal copy of the cmd/govulncheck/internal/govulncheck package in the vuln repo (https://go.googlesource.com/vuln).

The copy.sh does the copying, after removing all .go files here. To use it:

1. Clone the vuln repo to a directory next to the directory holding this repo (tools). After doing that your directory structure should look something like

   ~/repos/x/tools/gopls/...
   ~/repos/x/vuln/...
   

2. cd to this directory.

3. Run copy.sh.

Documentation

Overview

Package govulncheck supports the govulncheck command.

Index

• func FuncName(fn *vulncheck.FuncNode) string
• func LatestFixed(as []osv.Affected) string
• func LoadPackages(cfg *packages.Config, patterns ...string) ([]*vulncheck.Package, error)
• func PkgPath(fn *vulncheck.FuncNode) string
• func Source(ctx context.Context, pkgs []*vulncheck.Package, c client.Client) (*vulncheck.Result, error)
• func SummarizeCallStack(cs vulncheck.CallStack, topPkgs map[string]bool, vulnPkg string) string
• type CallInfo
  • func GetCallInfo(r *vulncheck.Result, pkgs []*vulncheck.Package) *CallInfo
• type FSCache
  • func DefaultCache() *FSCache
  • func (c *FSCache) ReadEntries(dbName string, p string) ([]*osv.Entry, error)
  • func (c *FSCache) ReadIndex(dbName string) (client.DBIndex, time.Time, error)
  • func (c *FSCache) WriteEntries(dbName string, p string, entries []*osv.Entry) error
  • func (c *FSCache) WriteIndex(dbName string, index client.DBIndex, retrieved time.Time) error
• type PackageError
  • func (e *PackageError) Error() string

Functions

func FuncName

func FuncName(fn *vulncheck.FuncNode) string

FuncName returns the function name from fn, adjusted to remove pointer annotations.

func LatestFixed

func LatestFixed(as []osv.Affected) string

LatestFixed returns the latest fixed version in the list of affected ranges, or the empty string if there are no fixed versions.

func LoadPackages

func LoadPackages(cfg *packages.Config, patterns ...string) ([]*vulncheck.Package, error)

LoadPackages loads the packages matching patterns using cfg, after setting the cfg mode flags that vulncheck needs for analysis. If the packages contain errors, a PackageError is returned containing a list of the errors, along with the packages themselves.

func PkgPath

func PkgPath(fn *vulncheck.FuncNode) string

PkgPath returns the package path from fn.

func Source

func Source(ctx context.Context, pkgs []*vulncheck.Package, c client.Client) (*vulncheck.Result, error)

Source calls vulncheck.Source on the Go source in pkgs. It returns the result with Vulns trimmed to those that are actually called.

This function is being used by the Go IDE team.

func SummarizeCallStack

func SummarizeCallStack(cs vulncheck.CallStack, topPkgs map[string]bool, vulnPkg string) string

SummarizeCallStack returns a short description of the call stack. It uses one of two forms, depending on what the lowest function F in topPkgs calls:

• If it calls a function V from the vulnerable package, then summarizeCallStack returns "F calls V".
• If it calls a function G in some other package, which eventually calls V, it returns "F calls G, which eventually calls V".

If it can't find any of these functions, summarizeCallStack returns the empty string.

Types

type CallInfo

type CallInfo struct {
	// CallStacks contains all call stacks to vulnerable functions.
	CallStacks map[*vulncheck.Vuln][]vulncheck.CallStack

	// VulnGroups contains vulnerabilities grouped by ID and package.
	VulnGroups [][]*vulncheck.Vuln

	// ModuleVersions is a map of module paths to versions.
	ModuleVersions map[string]string

	// TopPackages contains the top-level packages in the call info.
	TopPackages map[string]bool
}

CallInfo is information about calls to vulnerable functions.

func GetCallInfo

func GetCallInfo(r *vulncheck.Result, pkgs []*vulncheck.Package) *CallInfo

GetCallInfo computes call stacks and related information from a vulncheck.Result. It also makes a set of top-level packages from pkgs.

type FSCache

type FSCache struct {
	// contains filtered or unexported fields
}

FSCache is a thread-safe file-system cache implementing osv.Cache

TODO: use something like cmd/go/internal/lockedfile for thread safety?

func DefaultCache

func DefaultCache() *FSCache

func (*FSCache) ReadEntries

func (c *FSCache) ReadEntries(dbName string, p string) ([]*osv.Entry, error)

func (*FSCache) ReadIndex

func (c *FSCache) ReadIndex(dbName string) (client.DBIndex, time.Time, error)

func (*FSCache) WriteEntries

func (c *FSCache) WriteEntries(dbName string, p string, entries []*osv.Entry) error

func (*FSCache) WriteIndex

func (c *FSCache) WriteIndex(dbName string, index client.DBIndex, retrieved time.Time) error

type PackageError

type PackageError struct {
	Errors []packages.Error
}

A PackageError contains errors from loading a set of packages.

func (*PackageError) Error

func (e *PackageError) Error() string