Skip to content

Commit 78149ef

Browse files
hyangahhyangah
committed
src/goVulncheck: report unaffecting vulnerabilities separately
Unaffecting vulnerabilities = affect the required modules but call paths to the vulnerable symbols from the analyzed packages are not found. And, in the run summary section, report the count of affecting vulnerabilities. Change-Id: I9ddd0ffed4286e9e942a056ee299d438f8b5f21a Reviewed-on: https://go-review.googlesource.com/c/vscode-go/+/412317 Run-TryBot: Hyang-Ah Hana Kim <[email protected]> Reviewed-by: Jamal Carvalho <[email protected]> TryBot-Result: kokoro <[email protected]>
1 parent 445a42f commit 78149ef

File tree

4 files changed

+57
-15
lines changed

4 files changed

+57
-15
lines changed

‎media/vulncheckView.js

Lines changed: 29 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212

1313
const logContainer = /** @type {HTMLElement} */ (document.querySelector('.log'));
1414
const vulnsContainer = /** @type {HTMLElement} */ (document.querySelector('.vulns'));
15+
const unaffectingContainer = /** @type {HTMLElement} */ (document.querySelector('.unaffecting'));
1516

1617
vulnsContainer.addEventListener('click', (event) => {
1718
let node = event && event.target;
@@ -37,7 +38,12 @@
3738
}
3839

3940
function snapshotContent() {
40-
return vulnsContainer.innerHTML;
41+
const res = {
42+
'log': logContainer.innerHTML,
43+
'vulns': vulnsContainer.innerHTML,
44+
'unaffecting': unaffectingContainer.innerHTML
45+
};
46+
return JSON.stringify(res);
4147
}
4248

4349
/**
@@ -61,16 +67,19 @@
6167
return durationMillisec ? `${startDate} (took ${durationMillisec} msec)` : `${startDate}`;
6268
}
6369

70+
const vulns = json.Vuln || [];
71+
const affecting = vulns.filter((v) => v.CallStackSummaries?.length);
72+
const unaffecting = vulns.filter((v) => !v.CallStackSummaries?.length);
73+
6474
runLog.innerHTML = `
6575
<tr><td>Dir:</td><td>${json.Dir || ''}</td></tr>
6676
<tr><td>Pattern:</td><td>${json.Pattern || ''}</td></tr>
67-
<tr><td>Analyzed at:</td><td>${timeinfo(json.Start, json.Duration)}</td></tr>`;
77+
<tr><td>Analyzed at:</td><td>${timeinfo(json.Start, json.Duration)}</td></tr>
78+
<tr><td>Found ${affecting?.length || 0} known vulnerabilities</td></tr>`;
6879
logContainer.appendChild(runLog);
6980

70-
const vulns = json.Vuln || [];
7181
vulnsContainer.innerHTML = '';
72-
73-
vulns.forEach((vuln) => {
82+
affecting.forEach((vuln) => {
7483
const element = document.createElement('div');
7584
element.className = 'vuln';
7685
vulnsContainer.appendChild(element);
@@ -92,7 +101,7 @@
92101
details.className = 'vuln-details'
93102
details.innerHTML = `
94103
<tr><td>Package</td><td>${vuln.PkgPath}</td></tr>
95-
<tr><td>Current Version</td><td>${moduleVersion(vuln.ModPath, vuln.CurrentVersion)}</td></tr>
104+
<tr><td>Found in Version</td><td>${moduleVersion(vuln.ModPath, vuln.CurrentVersion)}</td></tr>
96105
<tr><td>Fixed Version</td><td>${moduleVersion(vuln.ModPath, vuln.FixedVersion)}</td></tr>
97106
<tr><td>Affecting</td><td>${vuln.AffectedPkgs?.join('<br>')}</td></tr>
98107
`;
@@ -131,6 +140,20 @@
131140
examples.appendChild(callstacksContainer);
132141
element.appendChild(examples);
133142
});
143+
144+
unaffectingContainer.innerText = '';
145+
if (unaffecting.length > 0) {
146+
unaffectingContainer.innerHTML = '<hr></hr><p>These vulnerabilities exist in required modules, but no vulnerable symbols are used.<br>No action is required. For more information, visit <a href="https://pkg.go.dev/vuln">https://pkg.go.dev/vuln</a></p>';
147+
148+
const details = document.createElement('table');
149+
unaffecting.forEach((vuln) => {
150+
const row = document.createElement('tr');
151+
row.className = 'vuln-details'
152+
row.innerHTML = `<tr><td>${vuln.ModPath}</td><td><a href="${vuln.URL}">${vuln.ID}</a></td></tr>`;
153+
details.appendChild(row);
154+
});
155+
unaffectingContainer.appendChild(details);
156+
}
134157
}
135158

136159
// Message Passing between Extension and Webview

‎src/goVulncheck.ts

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -97,9 +97,9 @@ export class VulncheckResultViewProvider implements vscode.CustomTextEditorProvi
9797
<title>Vulnerability Report - govulncheck</title>
9898
</head>
9999
<body>
100-
<div class="log"></div>
100+
<div class="log"></div>
101101
<div class="vulns"></div>
102-
102+
<div class="unaffecting"></div>
103103
<script nonce="${nonce}" src="${scriptUri}"></script>
104104
</body>
105105
</html>`;
@@ -201,7 +201,7 @@ export class VulncheckProvider {
201201
const start = new Date();
202202
const vuln = await vulncheck(goCtx, dir, pattern, this.channel);
203203

204-
if (vuln) {
204+
if (vuln?.Vuln?.length) {
205205
fillAffectedPkgs(vuln.Vuln);
206206

207207
// record run info.
@@ -222,7 +222,7 @@ export class VulncheckProvider {
222222
VulncheckResultViewProvider.viewType,
223223
viewColumn
224224
);
225-
this.channel.appendLine(`Vulncheck - result wrote in ${fname}`);
225+
this.channel.appendLine(`Vulncheck - result written in ${fname}`);
226226
} else {
227227
this.channel.appendLine('Vulncheck - found no vulnerability');
228228
}

‎test/gopls/vulncheck.test.ts

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,22 @@ suite('vulncheck result viewer tests', () => {
4949
const res = await watcher;
5050

5151
assert.deepStrictEqual(res.type, 'snapshot-result', `want snapshot-result, got ${JSON.stringify(res)}`);
52-
assert(res.target && res.target.includes('GO-2021-0113'), res.target);
52+
// res.target type is defined in vulncheckView.js.
53+
const { log = '', vulns = '', unaffecting = '' } = JSON.parse(res.target ?? '{}');
54+
55+
assert(
56+
log.includes('Found 1 known vulnerabilities'),
57+
`expected "1 known vulnerabilities", got ${JSON.stringify(res.target)}`
58+
);
59+
assert(
60+
vulns.includes('GO-2021-0113') &&
61+
vulns.includes('<td>Affecting</td><td>github.com/golang/vscode-go/test/testdata/vuln</td>'),
62+
`expected "Affecting" section, got ${JSON.stringify(res.target)}`
63+
);
64+
// Unaffecting vulnerability's detail is omitted, but its ID is reported.
5365
assert(
54-
res.target &&
55-
res.target.includes('<td>Affecting</td><td>github.com/golang/vscode-go/test/testdata/vuln</td>'),
56-
res.target
66+
unaffecting.includes('GO-2021-0000') && unaffecting.includes('golang.org/x/text'),
67+
`expected reports about unaffecting vulns, got ${JSON.stringify(res.target)}`
5768
);
5869
});
5970

@@ -77,7 +88,8 @@ suite('vulncheck result viewer tests', () => {
7788
webviewPanel.webview.postMessage({ type: 'snapshot-request' });
7889
const res = await watcher;
7990
assert.deepStrictEqual(res.type, 'snapshot-result', `want snapshot-result, got ${JSON.stringify(res)}`);
80-
assert(!res.target, res.target);
91+
const { log = '', vulns = '', unaffecting = '' } = JSON.parse(res.target ?? '{}');
92+
assert(!log && !vulns && !unaffecting, res.target);
8193
});
8294

8395
// TODO: test corrupted/incomplete json file handling.

‎test/testdata/vuln/test.vulncheck.json

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,13 @@
3636
"CallStackSummaries": [
3737
"github.com/golang/vscode-go/test/testdata/vuln.main calls golang.org/x/text/language.Parse"
3838
]
39+
},
40+
{
41+
"ID": "GO-2021-0000",
42+
"Details": "Bogus Report",
43+
"Symbol": "Parse",
44+
"ModPath": "golang.org/x/text",
45+
"URL": "https://pkg.go.dev/vuln/GO-2021-0000"
3946
}
4047
],
4148
"Start": "2022-05-16T13:43:54.437Z",

0 commit comments

Comments
 (0)