Include module names

[knqyf263]

Hi, thank you for the great database!

Looks like the current JSON API is missing module names. For example, the following YAML file includes the module name as well as the package name.

module: github.com/bytom/bytom
package: github.com/bytom/bytom/p2p/discover

vulndb/reports/GO-2021-0079.yaml

Line 1 in e0c00fa

module: github.com/bytom/bytom

On the other hand, the API doesn't include it.

$ curl https://storage.googleapis.com/go-vulndb/github.com/bytom/bytom/p2p/discover.json | jq .

[
  {
    "ID": "GO-2021-0079",
    "Published": "2021-04-14T12:00:00Z",
    "Modified": "2021-04-14T12:00:00Z",
    "Withdrawn": null,
    "Aliases": [
      "CVE-2018-18206"
    ],
    "Package": {
      "Name": "github.com/bytom/bytom/p2p/discover",
      "Ecosystem": "go"
    },
    "Details": "A malformed query can cause an out-of-bounds panic due to improper\nvalidation of arguments. If processing queries from untrusted\nparties, this may be used as a vector for denial of service\nattacks.\n",
    "Affects": {
      "Ranges": [
        {
          "Type": 2,
          "Introduced": "",
          "Fixed": "v1.0.4-0.20180831054840-1ac3c8ac4f2b"
        }
      ]
    },
    "References": [
      {
        "Type": "code review",
        "URL": "https://github.com/Bytom/bytom/pull/1307"
      },
      {
        "Type": "fix",
        "URL": "https://github.com/Bytom/bytom/commit/1ac3c8ac4f2b1e1df9675228290bda6b9586ba42"
      }
    ],
    "Extra": {
      "Go": {
        "Symbols": [
          "Network.checkTopicRegister"
        ],
        "URL": "https://go.googlesource.com/vulndb/+/refs/heads/main/reports/GO-2021-0079.toml"
      }
    }
  }
]

Is it possible to include it?

[josieang]

On another note, it seems that "github.com/bytom/bytom/p2p/discover" in the Package.Name field is just a directory, it's not a package or a module. Is the plan to allow vulnerabilities to be associated with directories?

[vearutop]

Maybe the idea is to check parent "directory" of a package until there is a module match or there is no parent.

[zpavlinovic]

Design of vulnerabilities is coupled with the vulnerability db layout. So the module info is not available in the json file per se, but it can be read from the relative path at which the json file is located in the db.

For instance, given db located at $DBPATH, the module path for json file

$DBPATH/github.com/some/module/foo.json

is github.com/some/module/foo.

[julieqiu]

Moved to the Go issue tracker: golang/go#50006.

The x/vulndb issue tracker is currently only meant for use by the Go security team for tracking CVEs that should be included in the Go vulnerability database.

[gopherbot]

Change https://go.dev/cl/460416 mentions this issue: data/reports: add GHSA to GO-2020-0001.yaml