Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(go): Do not trim v prefix from versions in Go Mod Analyzer #7733

Merged
merged 13 commits into from
Oct 31, 2024
Merged

fix(go): Do not trim v prefix from versions in Go Mod Analyzer #7733

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
bfaaffd
IS-7711: Do not trim v prefix from versions in Go Mod Analyzer
Rutam21 Oct 14, 2024
d35efdd
Updated test cases for Go Mod Analyzer
Rutam21 Oct 15, 2024
0cf549d
test(integration): update golden files
DmitriyLewen Oct 29, 2024
632d4bb
Merge branch 'main' of github.com:aquasecurity/trivy into FIX-7711
DmitriyLewen Oct 29, 2024
f6d07cb
fix(parser): don't trim `v` prefix
DmitriyLewen Oct 29, 2024
893a6a9
fix(analyzer): don't trim `v` to define license
DmitriyLewen Oct 29, 2024
b81d537
test(unit): fix tests
DmitriyLewen Oct 29, 2024
d5a787b
refactor(parser): add `v` prefix for `stdlib`
DmitriyLewen Oct 30, 2024
a1e6649
test: mage test:updateGolden
DmitriyLewen Oct 30, 2024
79a693b
refactor: add `v` prefix in tests
DmitriyLewen Oct 30, 2024
8667c72
refactor(docs): add `v` prefix
DmitriyLewen Oct 30, 2024
5b5b7f8
refactor(gobinary): add `v` prefix for `stdlib`
DmitriyLewen Oct 30, 2024
57a1231
Merge branch 'main' of github.com:aquasecurity/trivy into FIX-7711
DmitriyLewen Oct 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions docs/docs/supply-chain/vex/file.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ $ cat <<EOF > trivy.vex.cdx
},
"affects": [
{
"ref": "urn:cdx:3e671687-395b-41f5-a30f-a58921a69b79/1#pkg:golang/github.com/aws/aws-sdk-go@1.44.234"
"ref": "urn:cdx:3e671687-395b-41f5-a30f-a58921a69b79/1#pkg:golang/github.com/aws/aws-sdk-go@v1.44.234"
}
]
}
Expand Down Expand Up @@ -115,7 +115,7 @@ Total: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
┌───────────────────────────┬───────────────┬──────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
├───────────────────────────┼───────────────┼──────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ github.com/aws/aws-sdk-go │ CVE-2020-8912 │ LOW │ 1.44.234 │ │ aws-sdk-go: In-band key negotiation issue in AWS S3 Crypto │
│ github.com/aws/aws-sdk-go │ CVE-2020-8912 │ LOW │ v1.44.234 │ │ aws-sdk-go: In-band key negotiation issue in AWS S3 Crypto │
│ │ │ │ │ │ SDK for golang... │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-8912 │
└───────────────────────────┴───────────────┴──────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘
Expand Down Expand Up @@ -497,9 +497,9 @@ Now, suppose a VEX statement is issued for `Module B` as follows:
"vulnerability": {"name": "CVE-XXXX-YYYY"},
"products": [
{
"@id": "pkg:golang/module-b@1.0.0",
"@id": "pkg:golang/module-b@v1.0.0",
"subcomponents": [
{ "@id": "pkg:golang/module-c@2.0.0" }
{ "@id": "pkg:golang/module-c@v2.0.0" }
]
}
],
Expand Down
2 changes: 1 addition & 1 deletion integration/testdata/fixtures/vex/file/openvex.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
{
"@id": "pkg:golang/github.com/testdata/testdata",
"subcomponents": [
{ "@id": "pkg:golang/github.com/open-policy-agent/opa@0.35.0" }
{ "@id": "pkg:golang/github.com/open-policy-agent/opa@v0.35.0" }
]
}
],
Expand Down
24 changes: 12 additions & 12 deletions integration/testdata/gomod-skip.json.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,10 @@
"PkgID": "github.com/docker/distribution@v2.7.1+incompatible",
"PkgName": "github.com/docker/distribution",
"PkgIdentifier": {
"PURL": "pkg:golang/github.com/docker/distribution@2.7.1%2Bincompatible",
"UID": "de19cd663ca047a8"
"PURL": "pkg:golang/github.com/docker/distribution@v2.7.1%2Bincompatible",
"UID": "9d949a7b01249e68"
},
"InstalledVersion": "2.7.1+incompatible",
"InstalledVersion": "v2.7.1+incompatible",
"FixedVersion": "v2.8.0",
"Status": "fixed",
"Layer": {},
Expand All @@ -53,10 +53,10 @@
"PkgID": "github.com/open-policy-agent/opa@v0.35.0",
"PkgName": "github.com/open-policy-agent/opa",
"PkgIdentifier": {
"PURL": "pkg:golang/github.com/open-policy-agent/opa@0.35.0",
"UID": "6b685002e082ffc5"
"PURL": "pkg:golang/github.com/open-policy-agent/opa@v0.35.0",
"UID": "e89e2b0d8977e2a"
},
"InstalledVersion": "0.35.0",
"InstalledVersion": "v0.35.0",
"FixedVersion": "0.37.0",
"Status": "fixed",
"Layer": {},
Expand Down Expand Up @@ -100,10 +100,10 @@
"PkgID": "golang.org/x/text@v0.3.6",
"PkgName": "golang.org/x/text",
"PkgIdentifier": {
"PURL": "pkg:golang/golang.org/x/text@0.3.6",
"UID": "825dc613c0f39d45"
"PURL": "pkg:golang/golang.org/x/text@v0.3.6",
"UID": "3050088ce9eb2ce4"
},
"InstalledVersion": "0.3.6",
"InstalledVersion": "v0.3.6",
"FixedVersion": "0.3.7",
"Status": "fixed",
"Layer": {},
Expand Down Expand Up @@ -133,10 +133,10 @@
"PkgID": "github.com/docker/distribution@v2.7.1+incompatible",
"PkgName": "github.com/docker/distribution",
"PkgIdentifier": {
"PURL": "pkg:golang/github.com/docker/distribution@2.7.1%2Bincompatible",
"UID": "94376dc37054a7e8"
"PURL": "pkg:golang/github.com/docker/distribution@v2.7.1%2Bincompatible",
"UID": "2f7f0fa81860b8f1"
},
"InstalledVersion": "2.7.1+incompatible",
"InstalledVersion": "v2.7.1+incompatible",
"FixedVersion": "v2.8.0",
"Status": "fixed",
"Layer": {},
Expand Down
24 changes: 12 additions & 12 deletions integration/testdata/gomod-vex.json.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,10 @@
"PkgID": "github.com/docker/distribution@v2.7.1+incompatible",
"PkgName": "github.com/docker/distribution",
"PkgIdentifier": {
"PURL": "pkg:golang/github.com/docker/distribution@2.7.1%2Bincompatible",
"UID": "de19cd663ca047a8"
"PURL": "pkg:golang/github.com/docker/distribution@v2.7.1%2Bincompatible",
"UID": "9d949a7b01249e68"
},
"InstalledVersion": "2.7.1+incompatible",
"InstalledVersion": "v2.7.1+incompatible",
"FixedVersion": "v2.8.0",
"Status": "fixed",
"Layer": {},
Expand All @@ -53,10 +53,10 @@
"PkgID": "golang.org/x/text@v0.3.6",
"PkgName": "golang.org/x/text",
"PkgIdentifier": {
"PURL": "pkg:golang/golang.org/x/text@0.3.6",
"UID": "825dc613c0f39d45"
"PURL": "pkg:golang/golang.org/x/text@v0.3.6",
"UID": "3050088ce9eb2ce4"
},
"InstalledVersion": "0.3.6",
"InstalledVersion": "v0.3.6",
"FixedVersion": "0.3.7",
"Status": "fixed",
"Layer": {},
Expand Down Expand Up @@ -86,10 +86,10 @@
"PkgID": "github.com/docker/distribution@v2.7.1+incompatible",
"PkgName": "github.com/docker/distribution",
"PkgIdentifier": {
"PURL": "pkg:golang/github.com/docker/distribution@2.7.1%2Bincompatible",
"UID": "94376dc37054a7e8"
"PURL": "pkg:golang/github.com/docker/distribution@v2.7.1%2Bincompatible",
"UID": "2f7f0fa81860b8f1"
},
"InstalledVersion": "2.7.1+incompatible",
"InstalledVersion": "v2.7.1+incompatible",
"FixedVersion": "v2.8.0",
"Status": "fixed",
"Layer": {},
Expand Down Expand Up @@ -120,10 +120,10 @@
"PkgID": "github.com/docker/distribution@v2.7.1+incompatible",
"PkgName": "github.com/docker/distribution",
"PkgIdentifier": {
"PURL": "pkg:golang/github.com/docker/distribution@2.7.1%2Bincompatible",
"UID": "94306cdcf85fb50a"
"PURL": "pkg:golang/github.com/docker/distribution@v2.7.1%2Bincompatible",
"UID": "3ad40723ed2fce22"
},
"InstalledVersion": "2.7.1+incompatible",
"InstalledVersion": "v2.7.1+incompatible",
"FixedVersion": "v2.8.0",
"Status": "fixed",
"Layer": {},
Expand Down
30 changes: 15 additions & 15 deletions integration/testdata/gomod.json.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,10 @@
"PkgID": "github.com/docker/distribution@v2.7.1+incompatible",
"PkgName": "github.com/docker/distribution",
"PkgIdentifier": {
"PURL": "pkg:golang/github.com/docker/distribution@2.7.1%2Bincompatible",
"UID": "de19cd663ca047a8"
"PURL": "pkg:golang/github.com/docker/distribution@v2.7.1%2Bincompatible",
"UID": "9d949a7b01249e68"
},
"InstalledVersion": "2.7.1+incompatible",
"InstalledVersion": "v2.7.1+incompatible",
"FixedVersion": "v2.8.0",
"Status": "fixed",
"Layer": {},
Expand All @@ -53,10 +53,10 @@
"PkgID": "github.com/open-policy-agent/opa@v0.35.0",
"PkgName": "github.com/open-policy-agent/opa",
"PkgIdentifier": {
"PURL": "pkg:golang/github.com/open-policy-agent/opa@0.35.0",
"UID": "6b685002e082ffc5"
"PURL": "pkg:golang/github.com/open-policy-agent/opa@v0.35.0",
"UID": "e89e2b0d8977e2a"
},
"InstalledVersion": "0.35.0",
"InstalledVersion": "v0.35.0",
"FixedVersion": "0.37.0",
"Status": "fixed",
"Layer": {},
Expand Down Expand Up @@ -100,10 +100,10 @@
"PkgID": "golang.org/x/text@v0.3.6",
"PkgName": "golang.org/x/text",
"PkgIdentifier": {
"PURL": "pkg:golang/golang.org/x/text@0.3.6",
"UID": "825dc613c0f39d45"
"PURL": "pkg:golang/golang.org/x/text@v0.3.6",
"UID": "3050088ce9eb2ce4"
},
"InstalledVersion": "0.3.6",
"InstalledVersion": "v0.3.6",
"FixedVersion": "0.3.7",
"Status": "fixed",
"Layer": {},
Expand Down Expand Up @@ -133,10 +133,10 @@
"PkgID": "github.com/docker/distribution@v2.7.1+incompatible",
"PkgName": "github.com/docker/distribution",
"PkgIdentifier": {
"PURL": "pkg:golang/github.com/docker/distribution@2.7.1%2Bincompatible",
"UID": "94376dc37054a7e8"
"PURL": "pkg:golang/github.com/docker/distribution@v2.7.1%2Bincompatible",
"UID": "2f7f0fa81860b8f1"
},
"InstalledVersion": "2.7.1+incompatible",
"InstalledVersion": "v2.7.1+incompatible",
"FixedVersion": "v2.8.0",
"Status": "fixed",
"Layer": {},
Expand Down Expand Up @@ -167,10 +167,10 @@
"PkgID": "github.com/docker/distribution@v2.7.1+incompatible",
"PkgName": "github.com/docker/distribution",
"PkgIdentifier": {
"PURL": "pkg:golang/github.com/docker/distribution@2.7.1%2Bincompatible",
"UID": "94306cdcf85fb50a"
"PURL": "pkg:golang/github.com/docker/distribution@v2.7.1%2Bincompatible",
"UID": "3ad40723ed2fce22"
},
"InstalledVersion": "2.7.1+incompatible",
"InstalledVersion": "v2.7.1+incompatible",
"FixedVersion": "v2.8.0",
"Status": "fixed",
"Layer": {},
Expand Down
2 changes: 1 addition & 1 deletion pkg/dependency/id_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ func TestID(t *testing.T) {
args: args{
ltype: types.GoModule,
name: "test",
version: "1.0.0",
version: "v1.0.0",
},
want: "test@v1.0.0",
},
Expand Down
25 changes: 13 additions & 12 deletions pkg/dependency/parser/golang/mod/parse.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package mod

import (
"fmt"
"io"
"regexp"
"strconv"
Expand Down Expand Up @@ -90,21 +91,22 @@ func (p *Parser) Parse(r xio.ReadSeekerAt) ([]ftypes.Package, []ftypes.Dependenc
if p.useMinVersion {
if toolchainVer := toolchainVersion(modFileParsed.Toolchain, modFileParsed.Go); toolchainVer != "" {
pkgs["stdlib"] = ftypes.Package{
ID: packageID("stdlib", toolchainVer),
Name: "stdlib",
Version: toolchainVer,
ID: packageID("stdlib", toolchainVer),
Name: "stdlib",
// Our versioning library doesn't support canonical (goX.Y.Z) format,
// So we need to add `v` prefix for consistency (with module and dependency versions).
Version: fmt.Sprintf("v%s", toolchainVer),
Relationship: ftypes.RelationshipDirect, // Considered a direct dependency as the main module depends on the standard packages.
}
}
}

// Main module
if m := modFileParsed.Module; m != nil {
ver := strings.TrimPrefix(m.Mod.Version, "v")
pkgs[m.Mod.Path] = ftypes.Package{
ID: packageID(m.Mod.Path, ver),
ID: packageID(m.Mod.Path, m.Mod.Version),
Name: m.Mod.Path,
Version: ver,
Version: m.Mod.Version,
ExternalReferences: p.GetExternalRefs(m.Mod.Path),
Relationship: ftypes.RelationshipRoot,
}
Expand All @@ -116,11 +118,10 @@ func (p *Parser) Parse(r xio.ReadSeekerAt) ([]ftypes.Package, []ftypes.Dependenc
if skipIndirect && require.Indirect {
continue
}
ver := strings.TrimPrefix(require.Mod.Version, "v")
pkgs[require.Mod.Path] = ftypes.Package{
ID: packageID(require.Mod.Path, ver),
ID: packageID(require.Mod.Path, require.Mod.Version),
Name: require.Mod.Path,
Version: ver,
Version: require.Mod.Version,
Relationship: lo.Ternary(require.Indirect, ftypes.RelationshipIndirect, ftypes.RelationshipDirect),
ExternalReferences: p.GetExternalRefs(require.Mod.Path),
}
Expand All @@ -136,7 +137,7 @@ func (p *Parser) Parse(r xio.ReadSeekerAt) ([]ftypes.Package, []ftypes.Dependenc
}

// If the replace directive has a version on the left side, make sure it matches the version that was imported.
if rep.Old.Version != "" && old.Version != rep.Old.Version[1:] {
if rep.Old.Version != "" && old.Version != rep.Old.Version {
continue
}

Expand All @@ -153,9 +154,9 @@ func (p *Parser) Parse(r xio.ReadSeekerAt) ([]ftypes.Package, []ftypes.Dependenc

// Add replaced package to package register.
pkgs[rep.New.Path] = ftypes.Package{
ID: packageID(rep.New.Path, rep.New.Version[1:]),
ID: packageID(rep.New.Path, rep.New.Version),
Name: rep.New.Path,
Version: rep.New.Version[1:],
Version: rep.New.Version,
Relationship: old.Relationship,
ExternalReferences: p.GetExternalRefs(rep.New.Path),
}
Expand Down
Loading