genericosv

Documentation

Overview

File copied from github.com/google/osv-scanner@v1.8.0/pkg/models/constants.go

Copyright 2023 The Go Authors. All rights reserved. Use of this source code is governed by a BSD-style license that can be found in the LICENSE file.

Package genericosv provides utilities for working with generic OSV structs (not specialized for Go).

File copied from github.com/google/osv-scanner@v1.8.0/pkg/models/vulnerability.go

Index

• Variables
• func NewFetcher() report.Fetcher
• func NewGHSAFetcher(gc ghsaClient) report.Fetcher
• type Affected
  • func (a Affected) MarshalJSON() ([]byte, error)
• type Credit
• type CreditType
• type Ecosystem
• type Entry
  • func (e *Entry) AffectsGo() bool
  • func (e *Entry) IsWithdrawn() bool
  • func (osv *Entry) SourceID() string
  • func (e *Entry) ToReport(*proxy.Client, string) *report.Report
• type Event
• type Package
• type Range
• type RangeType
• type Reference
• type ReferenceType
• type Severity
• type SeverityType
• type Vulnerability
  • func (v Vulnerability) MarshalJSON() ([]byte, error)
  • func (v Vulnerability) MarshalYAML() (interface{}, error)

Variables

var Ecosystems = []Ecosystem{
	EcosystemGo,
	EcosystemNPM,
	EcosystemOSSFuzz,
	EcosystemPyPI,
	EcosystemRubyGems,
	EcosystemCratesIO,
	EcosystemPackagist,
	EcosystemMaven,
	EcosystemNuGet,
	EcosystemLinux,
	EcosystemDebian,
	EcosystemAlpine,
	EcosystemHex,
	EcosystemAndroid,
	EcosystemGitHubActions,
	EcosystemPub,
	EcosystemConanCenter,
	EcosystemRockyLinux,
	EcosystemAlmaLinux,
	EcosystemBitnami,
	EcosystemPhotonOS,
	EcosystemCRAN,
	EcosystemBioconductor,
	EcosystemSwiftURL,
}

Functions

func NewFetcher

func NewFetcher() report.Fetcher

func NewGHSAFetcher

func NewGHSAFetcher(gc ghsaClient) report.Fetcher

Types

type Affected

type Affected struct {
	Package           Package                `json:"package,omitempty"            yaml:"package,omitempty"`
	Severity          []Severity             `json:"severity,omitempty"           yaml:"severity,omitempty"`
	Ranges            []Range                `json:"ranges,omitempty"             yaml:"ranges,omitempty"`
	Versions          []string               `json:"versions,omitempty"           yaml:"versions,omitempty"`
	DatabaseSpecific  map[string]interface{} `json:"database_specific,omitempty"  yaml:"database_specific,omitempty"`
	EcosystemSpecific map[string]interface{} `json:"ecosystem_specific,omitempty" yaml:"ecosystem_specific,omitempty"`
}

Affected describes an affected package version, meaning one instance that contains the vulnerability.

See: https://ossf.github.io/osv-schema/#affected-fields

func (Affected) MarshalJSON

func (a Affected) MarshalJSON() ([]byte, error)

MarshalJSON implements the json.Marshaler interface.

This method ensures Package is only present if it is not equal to the zero value. This is achieved by embedding the Affected struct with a pointer to Package used to populate the "package" key in the JSON object.

type Credit

type Credit struct {
	Name    string     `json:"name"              yaml:"name"`
	Type    CreditType `json:"type,omitempty"    yaml:"type,omitempty"`
	Contact []string   `json:"contact,omitempty" yaml:"contact,omitempty"`
}

Credit gives credit for the discovery, confirmation, patch, or other events in the life cycle of a vulnerability.

See: https://ossf.github.io/osv-schema/#credits-fields

type CreditType

type CreditType string

const (
	CreditFinder               CreditType = "FINDER"
	CreditReporter             CreditType = "REPORTER"
	CreditAnalyst              CreditType = "ANALYST"
	CreditCoordinator          CreditType = "COORDINATOR"
	CreditRemediationDeveloper CreditType = "REMEDIATION_DEVELOPER" //nolint:gosec
	CreditRemediationReviewer  CreditType = "REMEDIATION_REVIEWER"  //nolint:gosec
	CreditRemediationVerifier  CreditType = "REMEDIATION_VERIFIER"  //nolint:gosec
	CreditTool                 CreditType = "TOOL"
	CreditSponsor              CreditType = "SPONSOR"
	CreditOther                CreditType = "OTHER"
)

type Ecosystem

type Ecosystem string

const (
	EcosystemGo            Ecosystem = "Go"
	EcosystemNPM           Ecosystem = "npm"
	EcosystemOSSFuzz       Ecosystem = "OSS-Fuzz"
	EcosystemPyPI          Ecosystem = "PyPI"
	EcosystemRubyGems      Ecosystem = "RubyGems"
	EcosystemCratesIO      Ecosystem = "crates.io"
	EcosystemPackagist     Ecosystem = "Packagist"
	EcosystemMaven         Ecosystem = "Maven"
	EcosystemNuGet         Ecosystem = "NuGet"
	EcosystemLinux         Ecosystem = "Linux"
	EcosystemDebian        Ecosystem = "Debian"
	EcosystemAlpine        Ecosystem = "Alpine"
	EcosystemHex           Ecosystem = "Hex"
	EcosystemAndroid       Ecosystem = "Android"
	EcosystemGitHubActions Ecosystem = "GitHub Actions"
	EcosystemPub           Ecosystem = "Pub"
	EcosystemConanCenter   Ecosystem = "ConanCenter"
	EcosystemRockyLinux    Ecosystem = "Rocky Linux"
	EcosystemAlmaLinux     Ecosystem = "AlmaLinux"
	EcosystemBitnami       Ecosystem = "Bitnami"
	EcosystemPhotonOS      Ecosystem = "Photon OS"
	EcosystemCRAN          Ecosystem = "CRAN"
	EcosystemBioconductor  Ecosystem = "Bioconductor"
	EcosystemSwiftURL      Ecosystem = "SwiftURL"
)

type Entry

type Entry Vulnerability

Entry is a a generic OSV entry, not specialized for Go.

func (*Entry) AffectsGo

func (e *Entry) AffectsGo() bool

func (*Entry) IsWithdrawn

func (e *Entry) IsWithdrawn() bool

func (*Entry) SourceID

func (osv *Entry) SourceID() string

func (*Entry) ToReport

func (e *Entry) ToReport(*proxy.Client, string) *report.Report

ToReport converts OSV into a Go Report with the given ID.

type Event

type Event struct {
	Introduced   string `json:"introduced,omitempty"    yaml:"introduced,omitempty"`
	Fixed        string `json:"fixed,omitempty"         yaml:"fixed,omitempty"`
	LastAffected string `json:"last_affected,omitempty" yaml:"last_affected,omitempty"`
	Limit        string `json:"limit,omitempty"         yaml:"limit,omitempty"`
}

Event describes a single version that either:

• Introduces a vulnerability: {"introduced": string}
• Fixes a vulnerability: {"fixed": string}
• Describes the last known affected version: {"last_affected": string}
• Sets an upper limit on the range being described: {"limit": string}

Event instances form part of a “timeline” of status changes for the affected package described by the Affected struct.

See: https://ossf.github.io/osv-schema/#affectedrangesevents-fields

type Package

type Package struct {
	Ecosystem Ecosystem `json:"ecosystem"      yaml:"ecosystem"`
	Name      string    `json:"name"           yaml:"name"`
	Purl      string    `json:"purl,omitempty" yaml:"purl,omitempty"`
}

Package identifies the affected code library or command provided by the package.

See: https://ossf.github.io/osv-schema/#affectedpackage-field

type Range

type Range struct {
	Type             RangeType              `json:"type"                        yaml:"type"`
	Events           []Event                `json:"events"                      yaml:"events"`
	Repo             string                 `json:"repo,omitempty"              yaml:"repo,omitempty"`
	DatabaseSpecific map[string]interface{} `json:"database_specific,omitempty" yaml:"database_specific,omitempty"`
}

Range describes the affected range of given version for a specific package.

See: https://ossf.github.io/osv-schema/#affectedranges-field

type RangeType

type RangeType string

const (
	RangeSemVer    RangeType = "SEMVER"
	RangeEcosystem RangeType = "ECOSYSTEM"
	RangeGit       RangeType = "GIT"
)

type Reference

type Reference struct {
	Type ReferenceType `json:"type" yaml:"type"`
	URL  string        `json:"url"  yaml:"url"`
}

Reference links to additional information, advisories, issue tracker entries, and so on about the vulnerability itself.

See: https://ossf.github.io/osv-schema/#references-field

type ReferenceType

type ReferenceType string

const (
	ReferenceAdvisory   ReferenceType = "ADVISORY"
	ReferenceArticle    ReferenceType = "ARTICLE"
	ReferenceDetection  ReferenceType = "DETECTION"
	ReferenceDiscussion ReferenceType = "DISCUSSION"
	ReferenceReport     ReferenceType = "REPORT"
	ReferenceFix        ReferenceType = "FIX"
	ReferenceIntroduced ReferenceType = "INTRODUCED"
	ReferencePackage    ReferenceType = "PACKAGE"
	ReferenceEvidence   ReferenceType = "EVIDENCE"
	ReferenceWeb        ReferenceType = "WEB"
)

type Severity

type Severity struct {
	Type  SeverityType `json:"type"  yaml:"type"`
	Score string       `json:"score" yaml:"score"`
}

Severity is used to describe the severity of a vulnerability for an affected package using one or more quantitative scoring methods.

See: https://ossf.github.io/osv-schema/#severity-field

type SeverityType

type SeverityType string

const (
	SeverityCVSSV2 SeverityType = "CVSS_V2"
	SeverityCVSSV3 SeverityType = "CVSS_V3"
	SeverityCVSSV4 SeverityType = "CVSS_V4"
)

type Vulnerability

type Vulnerability struct {
	SchemaVersion string     `json:"schema_version,omitempty"    yaml:"schema_version,omitempty"`
	ID            string     `json:"id"                          yaml:"id"`
	Modified      time.Time  `json:"modified"                    yaml:"modified"`
	Published     time.Time  `json:"published,omitempty"         yaml:"published,omitempty"`
	Withdrawn     time.Time  `json:"withdrawn,omitempty"         yaml:"withdrawn,omitempty"`
	Aliases       []string   `json:"aliases,omitempty"           yaml:"aliases,omitempty"`
	Related       []string   `json:"related,omitempty"           yaml:"related,omitempty"`
	Summary       string     `json:"summary,omitempty"           yaml:"summary,omitempty"`
	Details       string     `json:"details,omitempty"           yaml:"details,omitempty"`
	Affected      []Affected `json:"affected,omitempty"          yaml:"affected,omitempty"`
	// TODO(tatianabradley): There is a bug in Severity unmarshal.
	// We don't use this field, so it is ignored until we fix this.
	Severity         []Severity             `json:"-,omitempty"          yaml:"-,omitempty"`
	References       []Reference            `json:"references,omitempty"        yaml:"references,omitempty"`
	Credits          []Credit               `json:"credits,omitempty"           yaml:"credits,omitempty"`
	DatabaseSpecific map[string]interface{} `json:"database_specific,omitempty" yaml:"database_specific,omitempty"`
}

Vulnerability is the core Open Source Vulnerability (OSV) data type.

The full documentation for the schema is available at https://ossf.github.io/osv-schema.

func (Vulnerability) MarshalJSON

func (v Vulnerability) MarshalJSON() ([]byte, error)

MarshalJSON implements the json.Marshaler interface.

This method ensures times all times are formatted correctly according to the schema.

func (Vulnerability) MarshalYAML

func (v Vulnerability) MarshalYAML() (interface{}, error)

MarshalYAML implements the yaml.Marshaler interface.

This method ensures times all times are formatted correctly.