-
Notifications
You must be signed in to change notification settings - Fork 35
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support Go dependency scanning for pull requests #1012
Changes from 1 commit
7c53f3f
e58b9c3
891a59e
4b347c1
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -15,8 +15,8 @@ pull_request: | |
vulnerability_database_endpoint: https://api.osv.dev/v1/query | ||
package_repository: | ||
url: https://registry.npmjs.org | ||
- name: go | ||
- name: Go | ||
vulnerability_database_type: osv | ||
vulnerability_database_endpoint: https://vuln.go.dev | ||
vulnerability_database_endpoint: https://api.osv.dev/v1/query | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Ah, I see, while |
||
package_repository: | ||
url: https://proxy.golang.org |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -16,6 +16,7 @@ | |
package diff | ||
|
||
import ( | ||
"bufio" | ||
"encoding/json" | ||
"fmt" | ||
"strings" | ||
|
@@ -29,13 +30,44 @@ func newEcosystemParser(eco DependencyEcosystem) ecosystemParser { | |
switch eco { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. if you agree about the case-insensitive comparison, maybe we should change this to |
||
case DepEcosystemNPM: | ||
return npmParse | ||
case DepEcosystemGo: | ||
return goParse | ||
case DepEcosystemNone: | ||
return nil | ||
default: | ||
return nil | ||
} | ||
} | ||
|
||
func goParse(patch string) ([]*pb.Dependency, error) { | ||
scanner := bufio.NewScanner(strings.NewReader(patch)) | ||
var deps []*pb.Dependency | ||
|
||
for scanner.Scan() { | ||
line := scanner.Text() | ||
|
||
if strings.HasPrefix(line, "+") { | ||
fields := strings.Split(line, " ") | ||
if len(fields) > 2 && !strings.HasSuffix(fields[1], "/go.mod") { | ||
name, version := fields[0], fields[1] | ||
dep := &pb.Dependency{ | ||
Ecosystem: pb.DepEcosystem_DEP_ECOSYSTEM_GO, | ||
Name: name[1:], | ||
Version: version, | ||
} | ||
|
||
deps = append(deps, dep) | ||
} | ||
} | ||
} | ||
|
||
if err := scanner.Err(); err != nil { | ||
return nil, err | ||
} | ||
|
||
return deps, nil | ||
} | ||
|
||
type npmDependency struct { | ||
Version string `json:"version"` | ||
Resolved string `json:"resolved"` | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,89 @@ | ||
package diff | ||
|
||
import ( | ||
"testing" | ||
|
||
"github.com/stretchr/testify/assert" | ||
"google.golang.org/protobuf/proto" | ||
|
||
pb "github.com/stacklok/mediator/pkg/generated/protobuf/go/mediator/v1" | ||
) | ||
|
||
func TestGoParse(t *testing.T) { | ||
t.Parallel() | ||
|
||
tests := []struct { | ||
description string | ||
content string | ||
expectedCount int | ||
expectedDependencies []*pb.Dependency | ||
}{ | ||
{ | ||
description: "Single addition", | ||
content: ` | ||
+cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY= | ||
+cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM= | ||
cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY= | ||
cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=`, | ||
expectedCount: 1, | ||
expectedDependencies: []*pb.Dependency{ | ||
{ | ||
Ecosystem: pb.DepEcosystem_DEP_ECOSYSTEM_GO, | ||
Name: "cloud.google.com/go/compute", | ||
Version: "v1.23.0", | ||
}, | ||
}, | ||
}, | ||
{ | ||
description: "Single removal", | ||
content: ` | ||
-cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY= | ||
-cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM= | ||
cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY= | ||
cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=`, | ||
expectedCount: 0, | ||
expectedDependencies: nil, | ||
}, | ||
{ | ||
description: "Mixed additions and removals", | ||
content: ` | ||
-cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY= | ||
-cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM= | ||
+cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY= | ||
+cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA= | ||
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk= | ||
+dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=`, | ||
expectedCount: 2, | ||
expectedDependencies: []*pb.Dependency{ | ||
{ | ||
Ecosystem: pb.DepEcosystem_DEP_ECOSYSTEM_GO, | ||
Name: "cloud.google.com/go/compute/metadata", | ||
Version: "v0.2.3", | ||
}, | ||
{ | ||
Ecosystem: pb.DepEcosystem_DEP_ECOSYSTEM_GO, | ||
Name: "dario.cat/mergo", | ||
Version: "v1.0.0", | ||
}, | ||
}, | ||
}, | ||
} | ||
for _, tt := range tests { | ||
tt := tt | ||
t.Run(tt.description, func(t *testing.T) { | ||
t.Parallel() | ||
got, err := goParse(tt.content) | ||
if err != nil { | ||
t.Fatalf("goParse() returned error: %v", err) | ||
} | ||
|
||
assert.Equal(t, tt.expectedCount, len(got), "mismatched dependency count") | ||
|
||
for i, expectedDep := range tt.expectedDependencies { | ||
if !proto.Equal(expectedDep, got[i]) { | ||
t.Errorf("mismatch at index %d: expected %v, got %v", i, expectedDep, got[i]) | ||
} | ||
} | ||
}) | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
why did you change the name to start with an uppercase letter? btw I wonder if we should just compare the names in a case-insensitive manner so that we'd match all of go, Go, gO and GO.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
oh I understand now, OSV's databases are case-sensitive..I would honestly make the mediator ecosystems case-insensitive.. (but if you disagree, just tell me that it's a bad idea..).
tested with:
versus:
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, the names are case-sensitive and can be found here: https://ossf.github.io/osv-schema/#affectedpackage-field
I've changed it to lower-case mediator-wise, thanks.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Re-tested: