API Endpoint: Get Package Count by Ecosystem#1638
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds a new API endpoint /vulndb/affected-package-distribution/ to retrieve the count of affected packages grouped by ecosystem. The endpoint is intended for use in a frontend dashboard to display vulnerability distribution statistics.
Changes:
- Added new GET endpoint to the VulnDB router for retrieving ecosystem distribution
- Extended VulnDBController constructor to accept AffectedComponentRepository dependency
- Implemented GetEcosystemDistribution method that queries affected_components table and aggregates by ecosystem prefix
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| router/vulndb_router.go | Registered new /affected-package-distribution/ GET route in VulnDB router |
| controllers/vulndb_controller.go | Added affectedComponentRepository dependency, implemented GetEcosystemDistribution endpoint with SQL aggregation and manual JSON construction |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| sql := `SELECT ecosystem, COUNT(*) FROM affected_components GROUP BY ecosystem;` | ||
| err := c.affectedComponentRepository.GetDB(nil).Raw(sql).Find(&results).Error |
There was a problem hiding this comment.
The query SELECT ecosystem, COUNT(*) FROM affected_components GROUP BY ecosystem performs a full table scan and aggregation on the affected_components table, which could become slow as the table grows. Consider these optimizations:
- Add an index on the
ecosystemcolumn if one doesn't already exist - Consider caching this result since ecosystem distribution is relatively static data
- If the table is very large, consider using approximate counts or maintaining a materialized view
Since this appears to be a public endpoint (no authentication middleware on the vulndb router), performance is especially important to prevent potential DoS via repeated expensive queries.
| } | ||
|
|
||
| // group ecosystem by prefix ecosystem string and return the equivalent json encoding | ||
| func buildResultsJSON(rows []ecosystemRow) string { |
Added endpoint to retrieve amount of affected packages by ecosystem for @juliankepka frontend page.