Skip to content

Commit 05b914a

Browse files
knqyf263knqyf263
committed
Merge branch 'master' into add_module
2 parents 64e97da + c856ba8 commit 05b914a

File tree

5 files changed

+91
-102
lines changed

5 files changed

+91
-102
lines changed

‎client/client_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ import (
1818

1919
var testVuln1 string = `[
2020
{"ID":"ID1","Package":{"Name":"golang.org/example/one","Ecosystem":"go"}, "Summary":"",
21-
"Severity":2,"Affects":{"Ranges":[{"Type":2,"Introduced":"","Fixed":"v2.2.0"}]},
21+
"Severity":2,"Affects":{"Ranges":[{"Type":"SEMVER","Introduced":"","Fixed":"v2.2.0"}]},
2222
"ecosystem_specific":{"Symbols":["some_symbol_1"]
2323
}}]`
2424

2525
var testVuln2 string = `[
2626
{"ID":"ID2","Package":{"Name":"golang.org/example/two","Ecosystem":"go"}, "Summary":"",
27-
"Severity":2,"Affects":{"Ranges":[{"Type":2,"Introduced":"","Fixed":"v2.1.0"}]},
27+
"Severity":2,"Affects":{"Ranges":[{"Type":"SEMVER","Introduced":"","Fixed":"v2.1.0"}]},
2828
"ecosystem_specific":{"Symbols":["some_symbol_2"]
2929
}}]`
3030

‎deploy-db.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22
tmp_dir=$(mktemp -d -t vulndb-XXXX)
33
go run ./cmd/gendb -reports reports -out $tmp_dir
44
cd $tmp_dir
5-
gsutil cp -m -r . gs://go-vulndb
5+
gsutil -m cp -r . gs://go-vulndb
66
cd -
7-
rm -rf $tmp_dir
7+
rm -rf $tmp_dir

‎osv/json.go

+33-37
Original file line numberDiff line numberDiff line change
@@ -34,27 +34,27 @@ import (
3434
// vulndb implementatiion detail.
3535
type DBIndex map[string]time.Time
3636

37-
type AffectsRangeType int
37+
type AffectsRangeType string
3838

3939
const (
40-
TypeUnspecified AffectsRangeType = iota
41-
TypeGit
42-
TypeSemver
40+
TypeUnspecified AffectsRangeType = "UNSPECIFIED"
41+
TypeGit AffectsRangeType = "GIT"
42+
TypeSemver AffectsRangeType = "SEMVER"
4343
)
4444

4545
type Ecosystem string
4646

47-
const GoEcosystem Ecosystem = "go"
47+
const GoEcosystem Ecosystem = "Go"
4848

4949
type Package struct {
50-
Name string
51-
Ecosystem Ecosystem
50+
Name string `json:"name"`
51+
Ecosystem Ecosystem `json:"ecosystem"`
5252
}
5353

5454
type AffectsRange struct {
55-
Type AffectsRangeType
56-
Introduced string
57-
Fixed string
55+
Type AffectsRangeType `json:"type"`
56+
Introduced string `json:"introduced"`
57+
Fixed string `json:"fixed"`
5858
}
5959

6060
func (ar AffectsRange) containsSemver(v string) bool {
@@ -108,30 +108,28 @@ type GoSpecific struct {
108108
Symbols []string `json:",omitempty"`
109109
GOOS []string `json:",omitempty"`
110110
GOARCH []string `json:",omitempty"`
111-
URL string
111+
URL string `json:"url"`
112112
}
113113

114114
type Reference struct {
115-
Type string
116-
URL string
115+
Type string `json:"type"`
116+
URL string `json:"url"`
117117
}
118118

119119
// Entry represents a OSV style JSON vulnerability database
120120
// entry
121121
type Entry struct {
122-
ID string
123-
Module string
124-
Published time.Time
125-
Modified time.Time
126-
Withdrawn *time.Time `json:",omitempty"`
127-
Aliases []string `json:",omitempty"`
128-
Package Package
129-
Details string
130-
Affects Affects
131-
References []Reference `json:",omitempty"`
132-
Extra struct {
133-
Go GoSpecific
134-
}
122+
ID string `json:"id"`
123+
Module string `json:"module"`
124+
Published time.Time `json:"published"`
125+
Modified time.Time `json:"modified"`
126+
Withdrawn *time.Time `json:"withdrawn,omitempty"`
127+
Aliases []string `json:"aliases,omitempty"`
128+
Package Package `json:"package"`
129+
Details string `json:"details"`
130+
Affects Affects `json:"affects"`
131+
References []Reference `json:"references,omitempty"`
132+
EcosystemSpecific GoSpecific `json:"ecosystem_specific"`
135133
}
136134

137135
func Generate(id string, url string, r report.Report) []Entry {
@@ -155,24 +153,22 @@ func Generate(id string, url string, r report.Report) []Entry {
155153
},
156154
Details: r.Description,
157155
Affects: generateAffects(r.Versions),
158-
Extra: struct{ Go GoSpecific }{
159-
Go: GoSpecific{
160-
Symbols: r.Symbols,
161-
GOOS: r.OS,
162-
GOARCH: r.Arch,
163-
URL: url,
164-
},
156+
EcosystemSpecific: GoSpecific{
157+
Symbols: r.Symbols,
158+
GOOS: r.OS,
159+
GOARCH: r.Arch,
160+
URL: url,
165161
},
166162
}
167163

168164
if r.Links.PR != "" {
169-
entry.References = append(entry.References, Reference{Type: "code review", URL: r.Links.PR})
165+
entry.References = append(entry.References, Reference{Type: "FIX", URL: r.Links.PR})
170166
}
171167
if r.Links.Commit != "" {
172-
entry.References = append(entry.References, Reference{Type: "fix", URL: r.Links.Commit})
168+
entry.References = append(entry.References, Reference{Type: "FIX", URL: r.Links.Commit})
173169
}
174170
for _, link := range r.Links.Context {
175-
entry.References = append(entry.References, Reference{Type: "misc", URL: link})
171+
entry.References = append(entry.References, Reference{Type: "WEB", URL: link})
176172
}
177173

178174
if r.CVE != "" {
@@ -189,7 +185,7 @@ func Generate(id string, url string, r report.Report) []Entry {
189185
additionalImportPath = additional.Package
190186
}
191187
entryCopy.Package.Name = additionalImportPath
192-
entryCopy.Extra.Go.Symbols = additional.Symbols
188+
entryCopy.EcosystemSpecific.Symbols = additional.Symbols
193189
entryCopy.Affects = generateAffects(additional.Versions)
194190

195191
entries = append(entries, entryCopy)

‎osv/json_test.go

+22-35
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,7 @@ import (
1515
func TestGenerate(t *testing.T) {
1616
r := report.Report{
1717
Module: "example.com/vulnerable/v2",
18-
AdditionalPackages: []struct {
19-
Module string
20-
Package string
21-
Symbols []string
22-
Versions []report.VersionRange
23-
}{
18+
AdditionalPackages: []report.Additional{
2419
{
2520
Module: "vanity.host/vulnerable",
2621
Package: "vanity.host/vulnerable/package",
@@ -43,11 +38,7 @@ func TestGenerate(t *testing.T) {
4338
Symbols: []string{"A", "B.b"},
4439
OS: []string{"windows"},
4540
Arch: []string{"arm64"},
46-
Links: struct {
47-
PR string
48-
Commit string
49-
Context []string
50-
}{
41+
Links: report.Links{
5142
PR: "pr",
5243
Commit: "commit",
5344
Context: []string{"issue-a", "issue-b"},
@@ -60,7 +51,7 @@ func TestGenerate(t *testing.T) {
6051
Module: "example.com/vulnerable/v2",
6152
Package: Package{
6253
Name: "example.com/vulnerable/v2",
63-
Ecosystem: "go",
54+
Ecosystem: "Go",
6455
},
6556
Details: "It's a real bad one, I'll tell you that",
6657
Affects: Affects{
@@ -81,27 +72,25 @@ func TestGenerate(t *testing.T) {
8172
},
8273
},
8374
References: []Reference{
84-
Reference{Type: "code review", URL: "pr"},
85-
Reference{Type: "fix", URL: "commit"},
86-
Reference{Type: "misc", URL: "issue-a"},
87-
Reference{Type: "misc", URL: "issue-b"},
75+
Reference{Type: "FIX", URL: "pr"},
76+
Reference{Type: "FIX", URL: "commit"},
77+
Reference{Type: "WEB", URL: "issue-a"},
78+
Reference{Type: "WEB", URL: "issue-b"},
8879
},
8980
Aliases: []string{"CVE-0000-0000"},
90-
Extra: struct{ Go GoSpecific }{
91-
Go: GoSpecific{
92-
Symbols: []string{"A", "B.b"},
93-
GOOS: []string{"windows"},
94-
GOARCH: []string{"arm64"},
95-
URL: "https://vulns.golang.org/GO-1991-0001.html",
96-
},
81+
EcosystemSpecific: GoSpecific{
82+
Symbols: []string{"A", "B.b"},
83+
GOOS: []string{"windows"},
84+
GOARCH: []string{"arm64"},
85+
URL: "https://vulns.golang.org/GO-1991-0001.html",
9786
},
9887
},
9988
{
10089
ID: "GO-1991-0001",
10190
Module: "vanity.host/vulnerable",
10291
Package: Package{
10392
Name: "vanity.host/vulnerable/package",
104-
Ecosystem: "go",
93+
Ecosystem: "Go",
10594
},
10695
Details: "It's a real bad one, I'll tell you that",
10796
Affects: Affects{
@@ -122,19 +111,17 @@ func TestGenerate(t *testing.T) {
122111
},
123112
},
124113
References: []Reference{
125-
Reference{Type: "code review", URL: "pr"},
126-
Reference{Type: "fix", URL: "commit"},
127-
Reference{Type: "misc", URL: "issue-a"},
128-
Reference{Type: "misc", URL: "issue-b"},
114+
Reference{Type: "FIX", URL: "pr"},
115+
Reference{Type: "FIX", URL: "commit"},
116+
Reference{Type: "WEB", URL: "issue-a"},
117+
Reference{Type: "WEB", URL: "issue-b"},
129118
},
130119
Aliases: []string{"CVE-0000-0000"},
131-
Extra: struct{ Go GoSpecific }{
132-
Go: GoSpecific{
133-
Symbols: []string{"b", "A.b"},
134-
GOOS: []string{"windows"},
135-
GOARCH: []string{"arm64"},
136-
URL: "https://vulns.golang.org/GO-1991-0001.html",
137-
},
120+
EcosystemSpecific: GoSpecific{
121+
Symbols: []string{"b", "A.b"},
122+
GOOS: []string{"windows"},
123+
GOARCH: []string{"arm64"},
124+
URL: "https://vulns.golang.org/GO-1991-0001.html",
138125
},
139126
},
140127
}

‎report/report.go

+32-26
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,25 @@ type VersionRange struct {
1111
Fixed string `yaml:",omitempty"`
1212
}
1313

14+
type Additional struct {
15+
Module string `yaml:",omitempty"`
16+
Package string `yaml:",omitempty"`
17+
Symbols []string `yaml:",omitempty"`
18+
Versions []VersionRange `yaml:",omitempty"`
19+
}
20+
21+
type Links struct {
22+
PR string `yaml:",omitempty"`
23+
Commit string `yaml:",omitempty"`
24+
Context []string `yaml:",omitempty"`
25+
}
26+
27+
type CVEMeta struct {
28+
ID string `yaml:",omitempty"`
29+
CWE string `yaml:",omitempty"`
30+
Description string `yaml:",omitempty"`
31+
}
32+
1433
type Report struct {
1534
Module string `yaml:",omitempty"`
1635
Package string `yaml:",omitempty"`
@@ -26,30 +45,17 @@ type Report struct {
2645
// really be replaced with 'aliases', we'll still need
2746
// additional packages for some cases, but it's too heavy
2847
// for most
29-
AdditionalPackages []struct {
30-
Module string `yaml:",omitempty"`
31-
Package string `yaml:",omitempty"`
32-
Symbols []string `yaml:",omitempty"`
33-
Versions []VersionRange `yaml:",omitempty"`
34-
} `yaml:"additional_packages,omitempty"`
35-
Versions []VersionRange `yaml:",omitempty"`
36-
Description string `yaml:",omitempty"`
37-
Published time.Time `yaml:",omitempty"`
38-
LastModified *time.Time `yaml:"last_modified,omitempty"`
39-
Withdrawn *time.Time `yaml:",omitempty"`
40-
CVE string `yaml:",omitempty"`
41-
Credit string `yaml:",omitempty"`
42-
Symbols []string `yaml:",omitempty"`
43-
OS []string `yaml:",omitempty"`
44-
Arch []string `yaml:",omitempty"`
45-
Links struct {
46-
PR string `yaml:",omitempty"`
47-
Commit string `yaml:",omitempty"`
48-
Context []string `yaml:",omitempty"`
49-
} `yaml:",omitempty"`
50-
CVEMetadata *struct {
51-
ID string `yaml:",omitempty"`
52-
CWE string `yaml:",omitempty"`
53-
Description string `yaml:",omitempty"`
54-
} `yaml:"cve_metadata,omitempty"`
48+
AdditionalPackages []Additional `yaml:"additional_packages,omitempty"`
49+
Versions []VersionRange `yaml:",omitempty"`
50+
Description string `yaml:",omitempty"`
51+
Published time.Time `yaml:",omitempty"`
52+
LastModified *time.Time `yaml:"last_modified,omitempty"`
53+
Withdrawn *time.Time `yaml:",omitempty"`
54+
CVE string `yaml:",omitempty"`
55+
Credit string `yaml:",omitempty"`
56+
Symbols []string `yaml:",omitempty"`
57+
OS []string `yaml:",omitempty"`
58+
Arch []string `yaml:",omitempty"`
59+
Links Links `yaml:",omitempty"`
60+
CVEMetadata *CVEMeta `yaml:"cve_metadata,omitempty"`
5561
}

0 commit comments

Comments
 (0)