internal/report: fix formatting of "non go explanation"

- Only append a v prefix to (plausible) semver versions
- Don't add a period until the very end

Change-Id: I627774c66efb7b29f8f22fc3b7ae2ed30456d835
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/610808
LUCI-TryBot-Result: Go LUCI <[email protected]>
Reviewed-by: Damien Neil <[email protected]>

Author: tatianab

data/osv/GO-2024-2450.json

@@ -8,7 +8,7 @@
     "GHSA-w88v-pjr8-cmv2"
   ],
   "summary": "Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server",
-  "details": "Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/mattermost/mattermost-server before v7.8.10.; github.com/mattermost/mattermost/server/v8 before v8.1.1.",
+  "details": "Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/mattermost/mattermost-server before v7.8.10; github.com/mattermost/mattermost/server/v8 before v8.1.1.",
   "affected": [
     {
       "package": {

data/osv/GO-2024-2750.json

@@ -8,7 +8,7 @@
     "GHSA-2v35-wj4r-rcmv"
   ],
   "summary": "Kubernetes Secrets Store CSI Driver plugins arbitrary file write in github.com/Azure/secrets-store-csi-driver-provider-azure",
-  "details": "Kubernetes Secrets Store CSI Driver plugins arbitrary file write in github.com/Azure/secrets-store-csi-driver-provider-azure.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/Azure/secrets-store-csi-driver-provider-azure before v0.0.10.; github.com/hashicorp/vault-csi-provider before v0.0.6.",
+  "details": "Kubernetes Secrets Store CSI Driver plugins arbitrary file write in github.com/Azure/secrets-store-csi-driver-provider-azure.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/Azure/secrets-store-csi-driver-provider-azure before v0.0.10; github.com/hashicorp/vault-csi-provider before v0.0.6.",
   "affected": [
     {
       "package": {

data/osv/GO-2024-2924.json

@@ -8,7 +8,7 @@
     "GHSA-7jp9-vgmq-c8r5"
   ],
   "summary": "AdGuardHome privilege escalation vulnerability in github.com/AdguardTeam/AdGuardHome",
-  "details": "AdGuardHome privilege escalation vulnerability in github.com/AdguardTeam/AdGuardHome.",
+  "details": "AdGuardHome privilege escalation vulnerability in github.com/AdguardTeam/AdGuardHome.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: .",
   "affected": [
     {
       "package": {

data/osv/GO-2024-2979.json

@@ -8,7 +8,7 @@
     "GHSA-55r9-5mx9-qq7r"
   ],
   "summary": "Cache driver GetBlob() allows read access to any blob without access control check in zotregistry.dev/zot",
-  "details": "Cache driver GetBlob() allows read access to any blob without access control check in zotregistry.dev/zot.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: zotregistry.dev/zot before v2.1.0.; zotregistry.io/zot before v2.1.0.",
+  "details": "Cache driver GetBlob() allows read access to any blob without access control check in zotregistry.dev/zot.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: zotregistry.dev/zot before v2.1.0; zotregistry.io/zot before v2.1.0.",
   "affected": [
     {
       "package": {

internal/report/osv.go

@@ -19,6 +19,7 @@ import (
 	"golang.org/x/vulndb/internal/idstr"
 	"golang.org/x/vulndb/internal/osv"
 	"golang.org/x/vulndb/internal/stdlib"
+	"golang.org/x/vulndb/internal/version"
 )
 
 var (
@@ -51,10 +52,10 @@ func (r *Report) nonGoVersionsStr() string {
 	var vs []string
 	for _, m := range r.Modules {
 		if s := m.NonGoVersions.verboseString(); s != "" {
-			vs = append(vs, fmt.Sprintf("%s %s.", m.Module, s))
+			vs = append(vs, fmt.Sprintf("%s %s", m.Module, s))
 		}
 	}
-	return strings.Join(vs, "; ")
+	return strings.Join(vs, "; ") + "."
 }
 
 func (v Versions) verboseString() string {
@@ -94,7 +95,13 @@ func (vs Versions) collectRangePairs() []pair {
 		ps []pair
 		p  pair
 	)
-	prefix := "v"
+	addPrefix := func(s *string) {
+		const semverPrefix = "v"
+		if *s != "" && version.IsValid(*s) {
+			*s = semverPrefix + *s
+		}
+	}
+
 	for _, v := range vs {
 		if v.IsIntroduced() {
 			// We expected Introduced and Fixed to alternate, but if
@@ -104,15 +111,11 @@ func (vs Versions) collectRangePairs() []pair {
 			if p.intro == "0" {
 				p.intro = ""
 			}
-			if p.intro != "" {
-				p.intro = prefix + p.intro
-			}
+			addPrefix(&p.intro)
 		}
 		if v.IsFixed() {
 			p.fixed = v.Version
-			if p.fixed != "" {
-				p.fixed = prefix + p.fixed
-			}
+			addPrefix(&p.fixed)
 			ps = append(ps, p)
 			p = pair{}
 		}