|
| 1 | +package main |
| 2 | + |
| 3 | +import ( |
| 4 | + "encoding/json" |
| 5 | + "errors" |
| 6 | + "fmt" |
| 7 | + "io" |
| 8 | + "maps" |
| 9 | + "slices" |
| 10 | + "strings" |
| 11 | + |
| 12 | + "golang.org/x/mod/semver" |
| 13 | +) |
| 14 | + |
| 15 | +// stdlibModule is govulncheck's module name for the Go standard library. |
| 16 | +// Standard-library fixes map to a toolchain version and are handled by the |
| 17 | +// separate "Bump Go toolchain" workflow, so we skip them here. |
| 18 | +const stdlibModule = "stdlib" |
| 19 | + |
| 20 | +// advisoryBaseURL is the canonical advisory page for a GO-YYYY-NNNN ID. The |
| 21 | +// page cross-links the CVE alias and the per-package fixed version. |
| 22 | +const advisoryBaseURL = "https://pkg.go.dev/vuln/" |
| 23 | + |
| 24 | +// advisory identifies a Go vulnerability and its CVE alias. |
| 25 | +type advisory struct { |
| 26 | + ID string // GO-YYYY-NNNN, always present. |
| 27 | + CVE string // CVE-YYYY-NNNN, empty until one is assigned (it can lag the Go advisory by days). |
| 28 | +} |
| 29 | + |
| 30 | +// label is the link text for an advisory: the CVE when known, else the Go ID. |
| 31 | +func (a advisory) label() string { |
| 32 | + if a.CVE != "" { |
| 33 | + return a.CVE |
| 34 | + } |
| 35 | + return a.ID |
| 36 | +} |
| 37 | + |
| 38 | +// bump is a single dependency upgrade: the highest fixed version across all |
| 39 | +// advisories affecting a module, plus the advisories it resolves. |
| 40 | +type bump struct { |
| 41 | + Module string |
| 42 | + FixedVersion string |
| 43 | + Advisories []advisory |
| 44 | +} |
| 45 | + |
| 46 | +// govulncheckFinding mirrors the "finding" message emitted by |
| 47 | +// `govulncheck -format json`. See https://pkg.go.dev/golang.org/x/vuln/internal/govulncheck#Finding. |
| 48 | +type govulncheckFinding struct { |
| 49 | + OSV string `json:"osv"` |
| 50 | + FixedVersion string `json:"fixed_version"` |
| 51 | + Trace []struct { |
| 52 | + Module string `json:"module"` |
| 53 | + } `json:"trace"` |
| 54 | +} |
| 55 | + |
| 56 | +// govulncheckOSV mirrors the "osv" message emitted by `govulncheck -format json`, |
| 57 | +// which carries the full advisory record including its CVE aliases. |
| 58 | +type govulncheckOSV struct { |
| 59 | + ID string `json:"id"` |
| 60 | + Aliases []string `json:"aliases"` |
| 61 | +} |
| 62 | + |
| 63 | +// parseBumps reads the concatenated JSON stream from `govulncheck -format json` |
| 64 | +// and reduces it to one bump per module, choosing the highest fixed version and |
| 65 | +// collecting the advisories it resolves. The standard library is excluded. |
| 66 | +func parseBumps(r io.Reader) ([]bump, error) { |
| 67 | + // One accumulator per module: the highest fixed version seen and the set of |
| 68 | + // advisories resolved by upgrading to it. |
| 69 | + type acc struct { |
| 70 | + version string |
| 71 | + advisories map[string]struct{} |
| 72 | + } |
| 73 | + byModule := map[string]*acc{} |
| 74 | + // govulncheck emits a separate "osv" message per advisory; collect the CVE |
| 75 | + // aliases so findings (which carry only the Go ID) can be labelled with it. |
| 76 | + cveByID := map[string]string{} |
| 77 | + |
| 78 | + dec := json.NewDecoder(r) |
| 79 | + for { |
| 80 | + var msg struct { |
| 81 | + Finding *govulncheckFinding `json:"finding"` |
| 82 | + OSV *govulncheckOSV `json:"osv"` |
| 83 | + } |
| 84 | + err := dec.Decode(&msg) |
| 85 | + if errors.Is(err, io.EOF) { |
| 86 | + break |
| 87 | + } |
| 88 | + if err != nil { |
| 89 | + return nil, fmt.Errorf("decode govulncheck output: %w", err) |
| 90 | + } |
| 91 | + |
| 92 | + if o := msg.OSV; o != nil { |
| 93 | + cveByID[o.ID] = firstCVE(o.Aliases) |
| 94 | + } |
| 95 | + |
| 96 | + f := msg.Finding |
| 97 | + if f == nil || f.FixedVersion == "" || len(f.Trace) == 0 { |
| 98 | + continue |
| 99 | + } |
| 100 | + // trace[0] is the most specific frame; in module scan mode it carries |
| 101 | + // the vulnerable module itself. |
| 102 | + module := f.Trace[0].Module |
| 103 | + if module == "" || module == stdlibModule { |
| 104 | + continue |
| 105 | + } |
| 106 | + |
| 107 | + a := byModule[module] |
| 108 | + if a == nil { |
| 109 | + a = &acc{advisories: map[string]struct{}{}} |
| 110 | + byModule[module] = a |
| 111 | + } |
| 112 | + if a.version == "" || semver.Compare(f.FixedVersion, a.version) > 0 { |
| 113 | + a.version = f.FixedVersion |
| 114 | + } |
| 115 | + a.advisories[f.OSV] = struct{}{} |
| 116 | + } |
| 117 | + |
| 118 | + bumps := make([]bump, 0, len(byModule)) |
| 119 | + for module, a := range byModule { |
| 120 | + var advisories []advisory |
| 121 | + for _, id := range slices.Sorted(maps.Keys(a.advisories)) { |
| 122 | + advisories = append(advisories, advisory{ID: id, CVE: cveByID[id]}) |
| 123 | + } |
| 124 | + bumps = append(bumps, bump{ |
| 125 | + Module: module, |
| 126 | + FixedVersion: a.version, |
| 127 | + Advisories: advisories, |
| 128 | + }) |
| 129 | + } |
| 130 | + slices.SortFunc(bumps, func(a, b bump) int { |
| 131 | + return strings.Compare(a.Module, b.Module) |
| 132 | + }) |
| 133 | + return bumps, nil |
| 134 | +} |
| 135 | + |
| 136 | +// firstCVE returns the first CVE alias in the list, or "" if there is none. |
| 137 | +func firstCVE(aliases []string) string { |
| 138 | + for _, a := range aliases { |
| 139 | + if strings.HasPrefix(a, "CVE-") { |
| 140 | + return a |
| 141 | + } |
| 142 | + } |
| 143 | + return "" |
| 144 | +} |
| 145 | + |
| 146 | +// renderSummary formats the bumps as Markdown list items for the PR body. It |
| 147 | +// uses reference-style links so the list lines stay short instead of wrapping, |
| 148 | +// with the advisory link definitions collected in a block at the end. |
| 149 | +func renderSummary(bumps []bump) string { |
| 150 | + var list, refs strings.Builder |
| 151 | + seen := map[string]struct{}{} |
| 152 | + |
| 153 | + for _, bump := range bumps { |
| 154 | + labels := make([]string, len(bump.Advisories)) |
| 155 | + for i, adv := range bump.Advisories { |
| 156 | + labels[i] = "[" + adv.label() + "]" |
| 157 | + if _, ok := seen[adv.label()]; ok { |
| 158 | + continue |
| 159 | + } |
| 160 | + seen[adv.label()] = struct{}{} |
| 161 | + fmt.Fprintf(&refs, "[%s]: %s%s\n", adv.label(), advisoryBaseURL, adv.ID) |
| 162 | + } |
| 163 | + fmt.Fprintf(&list, "- %s → %s (fixes %s)\n", |
| 164 | + bump.Module, bump.FixedVersion, strings.Join(labels, ", ")) |
| 165 | + } |
| 166 | + |
| 167 | + if refs.Len() == 0 { |
| 168 | + return list.String() |
| 169 | + } |
| 170 | + return list.String() + "\n" + refs.String() |
| 171 | +} |
0 commit comments