Skip to content

Commit f6df334

Browse files
hogo6002hogo6002
committed
Merge remote-tracking branch 'upstream/main' into html
2 parents a083205 + 1cde7f4 commit f6df334

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

81 files changed

+1058
-892
lines changed

‎.golangci.yaml

+46
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,57 @@ linters-settings:
5555
disabled-checks:
5656
- ifElseChain
5757
revive:
58+
# enable-all-rules: true
5859
rules:
60+
# Overrides ----
61+
# This is just here for documentation purposes, as all rules are disabled by default
5962
- name: increment-decrement
6063
disabled: true
64+
# Defaults ----
65+
- name: blank-imports
66+
disabled: false
67+
- name: context-as-argument
68+
disabled: false
69+
- name: context-keys-type
70+
disabled: false
71+
- name: dot-imports
72+
disabled: false
73+
- name: empty-block
74+
disabled: false
75+
- name: error-naming
76+
disabled: false
77+
- name: error-return
78+
disabled: false
79+
- name: error-strings
80+
disabled: false
81+
- name: errorf
82+
disabled: false
83+
- name: exported
84+
disabled: false
6185
- name: indent-error-flow
6286
disabled: false
87+
- name: package-comments
88+
disabled: false
89+
- name: range
90+
disabled: false
91+
- name: receiver-naming
92+
disabled: false
93+
- name: redefines-builtin-id
94+
disabled: false
95+
- name: superfluous-else
96+
disabled: false
97+
- name: time-naming
98+
disabled: false
99+
- name: unexported-return
100+
disabled: false
101+
- name: unreachable-code
102+
disabled: false
103+
- name: unused-parameter
104+
disabled: false
105+
- name: var-declaration
106+
disabled: false
107+
- name: var-naming
108+
disabled: false
63109
nlreturn:
64110
# Size of the block (including return statement that is still "OK")
65111
# so no return split required.

‎cmd/osv-scanner/__snapshots__/main_test.snap

+86-152
Large diffs are not rendered by default.

‎cmd/osv-scanner/fix/main.go

+7-7
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,12 @@ const (
2929
)
3030

3131
type osvFixOptions struct {
32-
remediation.RemediationOptions
32+
remediation.Options
3333
Client client.ResolutionClient
3434
Manifest string
35-
ManifestRW manifest.ManifestIO
35+
ManifestRW manifest.ReadWriter
3636
Lockfile string
37-
LockfileRW lockfile.LockfileIO
37+
LockfileRW lockfile.ReadWriter
3838
RelockCmd string
3939
}
4040

@@ -60,7 +60,7 @@ func Command(stdout, stderr io.Writer, r *reporter.Reporter) *cli.Command {
6060
Name: "data-source",
6161
Usage: "source to fetch package information from; value can be: deps.dev, native",
6262
Value: "deps.dev",
63-
Action: func(ctx *cli.Context, s string) error {
63+
Action: func(_ *cli.Context, s string) error {
6464
if s != "deps.dev" && s != "native" {
6565
return fmt.Errorf("unsupported data-source \"%s\" - must be one of: deps.dev, native", s)
6666
}
@@ -238,7 +238,7 @@ func action(ctx *cli.Context, stdout, stderr io.Writer) (reporter.Reporter, erro
238238
r := reporter.NewTableReporter(stdout, stderr, reporter.InfoLevel, false, 0)
239239

240240
opts := osvFixOptions{
241-
RemediationOptions: remediation.RemediationOptions{
241+
Options: remediation.Options{
242242
ResolveOpts: resolution.ResolveOpts{
243243
MavenManagement: ctx.Bool("maven-fix-management"),
244244
},
@@ -260,7 +260,7 @@ func action(ctx *cli.Context, stdout, stderr io.Writer) (reporter.Reporter, erro
260260
system := resolve.UnknownSystem
261261

262262
if opts.Lockfile != "" {
263-
rw, err := lockfile.GetLockfileIO(opts.Lockfile)
263+
rw, err := lockfile.GetReadWriter(opts.Lockfile)
264264
if err != nil {
265265
return nil, err
266266
}
@@ -269,7 +269,7 @@ func action(ctx *cli.Context, stdout, stderr io.Writer) (reporter.Reporter, erro
269269
}
270270

271271
if opts.Manifest != "" {
272-
rw, err := manifest.GetManifestIO(opts.Manifest)
272+
rw, err := manifest.GetReadWriter(opts.Manifest)
273273
if err != nil {
274274
return nil, err
275275
}

‎cmd/osv-scanner/fix/model.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@ type model struct {
4343
err error // set if a fatal error occurs within the program
4444
writing bool // whether the model is currently shelling out writing lockfile/manifest file
4545

46-
inPlaceResult *remediation.InPlaceResult // results & patches from minimal / in-place resolution
47-
relockBaseRes *resolution.ResolutionResult // Base relock result, matching the current manifest on disk
48-
relockBaseResErrs []resolution.ResolutionError // Errors in base relock result
46+
inPlaceResult *remediation.InPlaceResult // results & patches from minimal / in-place resolution
47+
relockBaseRes *resolution.Result // Base relock result, matching the current manifest on disk
48+
relockBaseResErrs []resolution.NodeError // Errors in base relock result
4949
}
5050

5151
func newModel(ctx context.Context, opts osvFixOptions, cl client.ResolutionClient) model {
@@ -191,17 +191,17 @@ func doInPlaceResolution(ctx context.Context, cl client.ResolutionClient, opts o
191191
if err != nil {
192192
return inPlaceResolutionMsg{err: err}
193193
}
194-
res, err := remediation.ComputeInPlacePatches(ctx, cl, g, opts.RemediationOptions)
194+
res, err := remediation.ComputeInPlacePatches(ctx, cl, g, opts.Options)
195195

196196
return inPlaceResolutionMsg{res, g, err}
197197
}
198198

199199
type doRelockMsg struct {
200-
res *resolution.ResolutionResult
200+
res *resolution.Result
201201
err error
202202
}
203203

204-
func doRelock(ctx context.Context, cl client.ResolutionClient, m manif.Manifest, opts resolution.ResolveOpts, matchFn func(resolution.ResolutionVuln) bool) tea.Msg {
204+
func doRelock(ctx context.Context, cl client.ResolutionClient, m manif.Manifest, opts resolution.ResolveOpts, matchFn func(resolution.Vulnerability) bool) tea.Msg {
205205
res, err := resolution.Resolve(ctx, cl, m, opts)
206206
if err != nil {
207207
return doRelockMsg{nil, err}
@@ -226,7 +226,7 @@ func doInitialRelock(ctx context.Context, opts osvFixOptions) tea.Msg {
226226
if err != nil {
227227
return doRelockMsg{err: err}
228228
}
229-
opts.Client.PreFetch(ctx, m.Requirements, m.FilePath)
229+
client.PreFetch(ctx, opts.Client, m.Requirements, m.FilePath)
230230

231231
return doRelock(ctx, opts.Client, m, opts.ResolveOpts, opts.MatchVuln)
232232
}
@@ -240,7 +240,7 @@ func (s infoStringView) Resize(int, int) {}
240240

241241
var emptyInfoView = infoStringView("")
242242

243-
func resolutionErrorView(res *resolution.ResolutionResult, errs []resolution.ResolutionError) tui.ViewModel {
243+
func resolutionErrorView(res *resolution.Result, errs []resolution.NodeError) tui.ViewModel {
244244
if len(errs) == 0 {
245245
return emptyInfoView
246246
}

‎cmd/osv-scanner/fix/noninteractive.go

+30-29
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"deps.dev/util/resolve"
1313
"github.com/google/osv-scanner/internal/remediation"
1414
"github.com/google/osv-scanner/internal/resolution"
15+
"github.com/google/osv-scanner/internal/resolution/client"
1516
lf "github.com/google/osv-scanner/internal/resolution/lockfile"
1617
"github.com/google/osv-scanner/internal/resolution/manifest"
1718
"github.com/google/osv-scanner/pkg/lockfile"
@@ -36,7 +37,7 @@ func autoInPlace(ctx context.Context, r reporter.Reporter, opts osvFixOptions, m
3637
return err
3738
}
3839

39-
res, err := remediation.ComputeInPlacePatches(ctx, opts.Client, g, opts.RemediationOptions)
40+
res, err := remediation.ComputeInPlacePatches(ctx, opts.Client, g, opts.Options)
4041
if err != nil {
4142
return err
4243
}
@@ -57,7 +58,7 @@ func autoInPlace(ctx context.Context, r reporter.Reporter, opts osvFixOptions, m
5758
if i > 0 {
5859
r.Infof(",")
5960
}
60-
r.Infof("%s", v.Vulnerability.ID)
61+
r.Infof("%s", v.OSV.ID)
6162
}
6263
r.Infof("\n")
6364

@@ -72,7 +73,7 @@ func autoInPlace(ctx context.Context, r reporter.Reporter, opts osvFixOptions, m
7273

7374
// returns the top {maxUpgrades} compatible patches, the vulns fixed, and the number of potentially fixable vulns left unfixed
7475
// if maxUpgrades is < 0, do as many patches as possible
75-
func autoChooseInPlacePatches(res remediation.InPlaceResult, maxUpgrades int) ([]lf.DependencyPatch, []resolution.ResolutionVuln, int) {
76+
func autoChooseInPlacePatches(res remediation.InPlaceResult, maxUpgrades int) ([]lf.DependencyPatch, []resolution.Vulnerability, int) {
7677
// Keep track of the VersionKeys we've already patched so we know which patches are incompatible
7778
seenVKs := make(map[resolve.VersionKey]bool)
7879

@@ -83,7 +84,7 @@ func autoChooseInPlacePatches(res remediation.InPlaceResult, maxUpgrades int) ([
8384
}
8485
uniqueVulns := make(map[vulnKey]struct{})
8586
var patches []lf.DependencyPatch
86-
var fixed []resolution.ResolutionVuln
87+
var fixed []resolution.Vulnerability
8788

8889
for _, p := range res.Patches {
8990
vk := resolve.VersionKey{
@@ -93,7 +94,7 @@ func autoChooseInPlacePatches(res remediation.InPlaceResult, maxUpgrades int) ([
9394

9495
// add each of the resolved vulnKeys to the set of unique vulns
9596
for _, rv := range p.ResolvedVulns {
96-
uniqueVulns[vulnKey{id: rv.Vulnerability.ID, vk: vk}] = struct{}{}
97+
uniqueVulns[vulnKey{id: rv.OSV.ID, vk: vk}] = struct{}{}
9798
}
9899

99100
// If we still are picking more patches, and we haven't already patched this specific version,
@@ -107,7 +108,7 @@ func autoChooseInPlacePatches(res remediation.InPlaceResult, maxUpgrades int) ([
107108
}
108109

109110
// Sort the fixed vulns by ID for consistency.
110-
slices.SortFunc(fixed, func(a, b resolution.ResolutionVuln) int { return cmp.Compare(a.Vulnerability.ID, b.Vulnerability.ID) })
111+
slices.SortFunc(fixed, func(a, b resolution.Vulnerability) int { return cmp.Compare(a.OSV.ID, b.OSV.ID) })
111112

112113
return patches, fixed, len(uniqueVulns) - len(fixed)
113114
}
@@ -129,7 +130,7 @@ func autoRelock(ctx context.Context, r reporter.Reporter, opts osvFixOptions, ma
129130
return err
130131
}
131132

132-
opts.Client.PreFetch(ctx, manif.Requirements, manif.FilePath)
133+
client.PreFetch(ctx, opts.Client, manif.Requirements, manif.FilePath)
133134
res, err := resolution.Resolve(ctx, opts.Client, manif, opts.ResolveOpts)
134135
if err != nil {
135136
return err
@@ -145,7 +146,7 @@ func autoRelock(ctx context.Context, r reporter.Reporter, opts osvFixOptions, ma
145146
totalVulns := len(res.Vulns)
146147
r.Infof("Found %d vulnerabilities matching the filter\n", totalVulns)
147148

148-
allPatches, err := remediation.ComputeRelaxPatches(ctx, opts.Client, res, opts.RemediationOptions)
149+
allPatches, err := remediation.ComputeRelaxPatches(ctx, opts.Client, res, opts.Options)
149150
if err != nil {
150151
return err
151152
}
@@ -175,7 +176,7 @@ func autoRelock(ctx context.Context, r reporter.Reporter, opts osvFixOptions, ma
175176
if i > 0 {
176177
r.Infof(",")
177178
}
178-
r.Infof("%s", v.Vulnerability.ID)
179+
r.Infof("%s", v.OSV.ID)
179180
}
180181
r.Infof("\n")
181182

@@ -185,7 +186,7 @@ func autoRelock(ctx context.Context, r reporter.Reporter, opts osvFixOptions, ma
185186
// TODO: Consider potentially introduced vulnerabilities
186187

187188
r.Infof("Rewriting %s...\n", opts.Manifest)
188-
if err := manifest.Overwrite(opts.ManifestRW, opts.Manifest, manifest.ManifestPatch{Manifest: &manif, Deps: depPatches}); err != nil {
189+
if err := manifest.Overwrite(opts.ManifestRW, opts.Manifest, manifest.Patch{Manifest: &manif, Deps: depPatches}); err != nil {
189190
return err
190191
}
191192

@@ -225,10 +226,10 @@ func autoRelock(ctx context.Context, r reporter.Reporter, opts osvFixOptions, ma
225226

226227
// returns the top {maxUpgrades} compatible patches, and the vulns fixed
227228
// if maxUpgrades is < 0, do as many patches as possible
228-
func autoChooseRelockPatches(diffs []resolution.ResolutionDiff, maxUpgrades int) ([]manifest.DependencyPatch, []resolution.ResolutionVuln) {
229+
func autoChooseRelockPatches(diffs []resolution.Difference, maxUpgrades int) ([]manifest.DependencyPatch, []resolution.Vulnerability) {
229230
var patches []manifest.DependencyPatch
230231
pkgChanged := make(map[resolve.VersionKey]bool) // dependencies we've already applied a patch to
231-
var fixed []resolution.ResolutionVuln
232+
var fixed []resolution.Vulnerability
232233

233234
for _, diff := range diffs {
234235
// If we are not picking any more patches, or this patch is incompatible with existing patches, skip adding it to the patch list.
@@ -249,27 +250,27 @@ func autoChooseRelockPatches(diffs []resolution.ResolutionDiff, maxUpgrades int)
249250
}
250251

251252
// Sort the fixed vulns by ID for consistency.
252-
slices.SortFunc(fixed, func(a, b resolution.ResolutionVuln) int { return cmp.Compare(a.Vulnerability.ID, b.Vulnerability.ID) })
253+
slices.SortFunc(fixed, func(a, b resolution.Vulnerability) int { return cmp.Compare(a.OSV.ID, b.OSV.ID) })
253254

254255
return patches, fixed
255256
}
256257

257-
func relockUnfixableVulns(diffs []resolution.ResolutionDiff) []*resolution.ResolutionVuln {
258+
func relockUnfixableVulns(diffs []resolution.Difference) []*resolution.Vulnerability {
258259
if len(diffs) == 0 {
259260
return nil
260261
}
261262
// find every vuln ID fixed in any patch
262263
fixableVulnIDs := make(map[string]struct{})
263264
for _, diff := range diffs {
264265
for _, v := range diff.RemovedVulns {
265-
fixableVulnIDs[v.Vulnerability.ID] = struct{}{}
266+
fixableVulnIDs[v.OSV.ID] = struct{}{}
266267
}
267268
}
268269

269270
// select only vulns that aren't fixed in any patch
270-
var unfixable []*resolution.ResolutionVuln
271+
var unfixable []*resolution.Vulnerability
271272
for i, v := range diffs[0].Original.Vulns {
272-
if _, ok := fixableVulnIDs[v.Vulnerability.ID]; !ok {
273+
if _, ok := fixableVulnIDs[v.OSV.ID]; !ok {
273274
unfixable = append(unfixable, &diffs[0].Original.Vulns[i])
274275
}
275276
}
@@ -294,7 +295,7 @@ func autoOverride(ctx context.Context, r reporter.Reporter, opts osvFixOptions,
294295
return err
295296
}
296297

297-
opts.Client.PreFetch(ctx, manif.Requirements, manif.FilePath)
298+
client.PreFetch(ctx, opts.Client, manif.Requirements, manif.FilePath)
298299
res, err := resolution.Resolve(ctx, opts.Client, manif, opts.ResolveOpts)
299300
if err != nil {
300301
return err
@@ -310,7 +311,7 @@ func autoOverride(ctx context.Context, r reporter.Reporter, opts osvFixOptions,
310311
totalVulns := len(res.Vulns)
311312
r.Infof("Found %d vulnerabilities matching the filter\n", totalVulns)
312313

313-
allPatches, err := remediation.ComputeOverridePatches(ctx, opts.Client, res, opts.RemediationOptions)
314+
allPatches, err := remediation.ComputeOverridePatches(ctx, opts.Client, res, opts.Options)
314315
if err != nil {
315316
return err
316317
}
@@ -340,7 +341,7 @@ func autoOverride(ctx context.Context, r reporter.Reporter, opts osvFixOptions,
340341
if i > 0 {
341342
r.Infof(",")
342343
}
343-
r.Infof("%s", v.Vulnerability.ID)
344+
r.Infof("%s", v.OSV.ID)
344345
}
345346
r.Infof("\n")
346347

@@ -350,21 +351,21 @@ func autoOverride(ctx context.Context, r reporter.Reporter, opts osvFixOptions,
350351
// TODO: Consider potentially introduced vulnerabilities
351352

352353
r.Infof("Rewriting %s...\n", opts.Manifest)
353-
if err := manifest.Overwrite(opts.ManifestRW, opts.Manifest, manifest.ManifestPatch{Manifest: &manif, Deps: depPatches}); err != nil {
354+
if err := manifest.Overwrite(opts.ManifestRW, opts.Manifest, manifest.Patch{Manifest: &manif, Deps: depPatches}); err != nil {
354355
return err
355356
}
356357

357358
return nil
358359
}
359360

360-
func autoChooseOverridePatches(diffs []resolution.ResolutionDiff, maxUpgrades int) ([]manifest.DependencyPatch, []resolution.ResolutionVuln) {
361+
func autoChooseOverridePatches(diffs []resolution.Difference, maxUpgrades int) ([]manifest.DependencyPatch, []resolution.Vulnerability) {
361362
if maxUpgrades == 0 {
362363
return nil, nil
363364
}
364365

365366
var patches []manifest.DependencyPatch
366-
pkgChanged := make(map[resolve.PackageKey]bool) // dependencies we've already applied a patch to
367-
fixedVulns := make(map[string]resolution.ResolutionVuln) // vulns that have already been fixed by a patch
367+
pkgChanged := make(map[resolve.PackageKey]bool) // dependencies we've already applied a patch to
368+
fixedVulns := make(map[string]resolution.Vulnerability) // vulns that have already been fixed by a patch
368369
for _, diff := range diffs {
369370
// If this patch is incompatible with existing patches, skip adding it to the patch list.
370371

@@ -377,7 +378,7 @@ func autoChooseOverridePatches(diffs []resolution.ResolutionDiff, maxUpgrades in
377378
// e.g. We have {foo@1 -> bar@1}, and two possible patches [foo@3, bar@2].
378379
// Patching foo@3 makes {foo@3 -> bar@3}, which also fixes the vulnerability in bar.
379380
// Applying both patches would force {foo@3 -> bar@2}, which is less desirable.
380-
if slices.ContainsFunc(diff.RemovedVulns, func(rv resolution.ResolutionVuln) bool { _, ok := fixedVulns[rv.Vulnerability.ID]; return ok }) {
381+
if slices.ContainsFunc(diff.RemovedVulns, func(rv resolution.Vulnerability) bool { _, ok := fixedVulns[rv.OSV.ID]; return ok }) {
381382
continue
382383
}
383384

@@ -387,7 +388,7 @@ func autoChooseOverridePatches(diffs []resolution.ResolutionDiff, maxUpgrades in
387388
pkgChanged[dp.Pkg] = true
388389
}
389390
for _, rv := range diff.RemovedVulns {
390-
fixedVulns[rv.Vulnerability.ID] = rv
391+
fixedVulns[rv.OSV.ID] = rv
391392
}
392393

393394
maxUpgrades--
@@ -398,13 +399,13 @@ func autoChooseOverridePatches(diffs []resolution.ResolutionDiff, maxUpgrades in
398399

399400
// Sort the fixed vulns by ID for consistency.
400401
fixed := maps.Values(fixedVulns)
401-
slices.SortFunc(fixed, func(a, b resolution.ResolutionVuln) int { return cmp.Compare(a.Vulnerability.ID, b.Vulnerability.ID) })
402+
slices.SortFunc(fixed, func(a, b resolution.Vulnerability) int { return cmp.Compare(a.OSV.ID, b.OSV.ID) })
402403

403404
return patches, fixed
404405
}
405406

406-
func resolutionErrorString(res *resolution.ResolutionResult, errs []resolution.ResolutionError) string {
407-
// we pass in the []ResolutionErrors because calling res.Errors() is costly
407+
func resolutionErrorString(res *resolution.Result, errs []resolution.NodeError) string {
408+
// we pass in the []resolution.NodeError because calling res.Errors() is costly
408409
s := strings.Builder{}
409410
for _, e := range errs {
410411
node := res.Graph.Nodes[e.NodeID]

0 commit comments

Comments
 (0)