internal/sarif: add code flows

A code flow is a compact representation of a trace used for the textual output of govulncheck. For that purpose, the logic for trace compaction is extracted into a separate internal package traces. We also add the message portion of Location object for code flows to reduce the number of CLs; the actual physical region part will come in following CLs. To make things consistent, we also add the Message part of the location for stacks. Updates golang/go#61347 Change-Id: I99065a7aab7aa794e7a08687cb4055bc21a610f8 Reviewed-on: https://go-review.googlesource.com/c/vuln/+/551375 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com> Reviewed-by: Maceo Thompson <maceothompson@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
golang · Apr 3, 2024 · d00c170 · d00c170
1 parent 9fbf042
commit d00c170
Show file tree

Hide file tree

Showing 9 changed files with 565 additions and 40 deletions.
diff --git a/cmd/govulncheck/testdata/common/testfiles/binary-call/binary_sarif.ct b/cmd/govulncheck/testdata/common/testfiles/binary-call/binary_sarif.ct
@@ -116,6 +116,31 @@ $ govulncheck -format sarif -mode binary ${common_vuln_binary}
           "message": {
             "text": "Your code calls vulnerable functions in 1 package (github.com/tidwall/gjson)."
           },
+          "codeFlows": [
+            {
+              "threadFlows": [
+                {
+                  "locations": [
+                    {
+                      "module": "github.com/tidwall/gjson",
+                      "location": {
+                        "physicalLocation": {
+                          "artifactLocation": {},
+                          "region": {}
+                        },
+                        "message": {
+                          "text": "github.com/tidwall/gjson.Result.ForEach"
+                        }
+                      }
+                    }
+                  ]
+                }
+              ],
+              "message": {
+                "text": "A summarized code flow for vulnerable function github.com/tidwall/gjson.Result.ForEach"
+              }
+            }
+          ],
           "stacks": [
             {
               "message": {
@@ -129,7 +154,9 @@ $ govulncheck -format sarif -mode binary ${common_vuln_binary}
                       "artifactLocation": {},
                       "region": {}
                     },
-                    "message": {}
+                    "message": {
+                      "text": "github.com/tidwall/gjson.Result.ForEach"
+                    }
                   }
                 }
               ]
@@ -142,6 +169,31 @@ $ govulncheck -format sarif -mode binary ${common_vuln_binary}
           "message": {
             "text": "Your code calls vulnerable functions in 1 package (golang.org/x/text/language)."
           },
+          "codeFlows": [
+            {
+              "threadFlows": [
+                {
+                  "locations": [
+                    {
+                      "module": "golang.org/x/text",
+                      "location": {
+                        "physicalLocation": {
+                          "artifactLocation": {},
+                          "region": {}
+                        },
+                        "message": {
+                          "text": "golang.org/x/text/language.Parse"
+                        }
+                      }
+                    }
+                  ]
+                }
+              ],
+              "message": {
+                "text": "A summarized code flow for vulnerable function golang.org/x/text/language.Parse"
+              }
+            }
+          ],
           "stacks": [
             {
               "message": {
@@ -155,7 +207,9 @@ $ govulncheck -format sarif -mode binary ${common_vuln_binary}
                       "artifactLocation": {},
                       "region": {}
                     },
-                    "message": {}
+                    "message": {
+                      "text": "golang.org/x/text/language.Parse"
+                    }
                   }
                 }
               ]
@@ -168,6 +222,54 @@ $ govulncheck -format sarif -mode binary ${common_vuln_binary}
           "message": {
             "text": "Your code calls vulnerable functions in 1 package (github.com/tidwall/gjson)."
           },
+          "codeFlows": [
+            {
+              "threadFlows": [
+                {
+                  "locations": [
+                    {
+                      "module": "github.com/tidwall/gjson",
+                      "location": {
+                        "physicalLocation": {
+                          "artifactLocation": {},
+                          "region": {}
+                        },
+                        "message": {
+                          "text": "github.com/tidwall/gjson.Get"
+                        }
+                      }
+                    }
+                  ]
+                }
+              ],
+              "message": {
+                "text": "A summarized code flow for vulnerable function github.com/tidwall/gjson.Get"
+              }
+            },
+            {
+              "threadFlows": [
+                {
+                  "locations": [
+                    {
+                      "module": "github.com/tidwall/gjson",
+                      "location": {
+                        "physicalLocation": {
+                          "artifactLocation": {},
+                          "region": {}
+                        },
+                        "message": {
+                          "text": "github.com/tidwall/gjson.Result.Get"
+                        }
+                      }
+                    }
+                  ]
+                }
+              ],
+              "message": {
+                "text": "A summarized code flow for vulnerable function github.com/tidwall/gjson.Result.Get"
+              }
+            }
+          ],
           "stacks": [
             {
               "message": {
@@ -181,7 +283,9 @@ $ govulncheck -format sarif -mode binary ${common_vuln_binary}
                       "artifactLocation": {},
                       "region": {}
                     },
-                    "message": {}
+                    "message": {
+                      "text": "github.com/tidwall/gjson.Get"
+                    }
                   }
                 }
               ]
@@ -198,7 +302,9 @@ $ govulncheck -format sarif -mode binary ${common_vuln_binary}
                       "artifactLocation": {},
                       "region": {}
                     },
-                    "message": {}
+                    "message": {
+                      "text": "github.com/tidwall/gjson.Result.Get"
+                    }
                   }
                 }
               ]