x/pkgsite: link symbols on pkg.go.dev/vuln pages to the corresponding pkg.go.dev/<path>#<symbol>

[julieqiu]

It would be nice if symbols on the pkg.go.dev/vuln pages linked to the corresponding symbol on the pkg.go.dev package page.

For example, on https://pkg.go.dev/vuln/GO-2021-0242, Rat.SetString and Rat.UnmarshalText should link to https://pkg.go.dev/math/big#Rat.SetString and https://pkg.go.dev/math/big#Rat.UnmarshalText.

We could change the description field to a markdown type in the yaml reports, and have it parsed by pkgsite when rendering the page.

/cc @golang/vulndb @golang/pkgsite

[julieqiu]

The details field for OSV supports markdown: https://ossf.github.io/osv-schema/#summary-details-fields.

We currently only populate details (example: https://vuln.go.dev/golang.org/x/text.json).

[jba]

What about using Affected.EcosystemSpecific.Symbols instead?

[julieqiu]

A lot of times Affected.EcosystemSpecific.Symbols won't contain exported symbols, but I think it is a good idea to link to them if they are.

These are currently also not listed on the pkg.go.dev/vuln pages.

[hyangah]

This is fixed.