reports: more consistent description tone

Also remove a few improper reports, and format all of the YAML
a bit more nicely.

Change-Id: I1d4d79578228a775489c286991dbe1386e079a66
Reviewed-on: https://team-review.git.corp.google.com/c/golang/vulndb/+/1062398
Reviewed-by: Roland Shoemaker <bracewell@google.com>

Author: rolandshoemaker

osv/json.go

@@ -51,7 +51,7 @@ func (ar AffectsRange) containsSemver(v string) bool {
 }
 
 type Affects struct {
-	Ranges []AffectsRange
+	Ranges []AffectsRange `json:",omitempty"`
 }
 
 func generateAffects(versions []report.VersionRange) Affects {
@@ -106,8 +106,8 @@ type Entry struct {
 	ID         string
 	Published  time.Time
 	Modified   time.Time
-	Withdrawn  *time.Time
-	Aliases    []string `json:",omitempty"`
+	Withdrawn  *time.Time `json:",omitempty"`
+	Aliases    []string   `json:",omitempty"`
 	Package    Package
 	Details    string
 	Affects    Affects

reports/GO-2020-0001.yaml

@@ -1,20 +1,20 @@
 module: github.com/gin-gonic/gin
 versions:
-- fixed: v1.6.0
+  - fixed: v1.6.0
 description: |
   The default [`Formatter`][LoggerConfig.Formatter] for the [`Logger`][] middleware
   (included in the [`Default`][] engine) allows attackers to inject arbitrary log
   entries by manipulating the request path.
 published: 2021-04-14T12:00:00Z
-credit: '@thinkerou <thinkerou@gmail.com>'
+credit: "@thinkerou <thinkerou@gmail.com>"
 symbols:
-- defaultLogFormatter
+  - defaultLogFormatter
 links:
   pr: https://github.com/gin-gonic/gin/pull/2237
   commit: https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d
 cve_metadata:
   id: CVE-9999-0001
-  cwe: 'CWE-20: Improper Input Validation'
+  cwe: "CWE-20: Improper Input Validation"
   description: |
     Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0
     allows remote attackers to inject arbitary log lines.

reports/GO-2020-0002.yaml

@@ -1,6 +1,6 @@
 module: github.com/proglottis/gpgme
 versions:
-- fixed: v0.1.1
+  - fixed: v0.1.1
 description: |
   The [`Data`][], [`Context`][], or [`Key`][] finalizers might run during or
   before GPGME operations, releasing the C structures as they are still in use,

reports/GO-2020-0003.yaml

@@ -1,21 +1,21 @@
 module: github.com/revel/revel
 versions:
-- fixed: v1.0.0
+  - fixed: v1.0.0
 description: |
   If the application accepts
   [slice parameters](https://revel.github.io/manual/parameters.html#slices), an
   attacker can cause the application to allocate large amounts of memory and
   crash by manipulating the request query.
 published: 2021-04-14T12:00:00Z
-credit: '@SYM01'
+credit: "@SYM01"
 links:
   pr: https://github.com/revel/revel/pull/1427
   commit: https://github.com/revel/revel/commit/d160ecb72207824005b19778594cbdc272e8a605
   context:
-  - https://github.com/revel/revel/issues/1424
+    - https://github.com/revel/revel/issues/1424
 cve_metadata:
   id: CVE-9999-0002
-  cwe: 'CWE-400: Uncontrolled Resource Consumption'
+  cwe: "CWE-400: Uncontrolled Resource Consumption"
   description: |
     Unsanitized input in the query parser in github.com/revel/revel before v1.0.0
     allows remote attackers to cause resource exhaustion via memory allocation.

reports/GO-2020-0004.yaml

@@ -1,7 +1,7 @@
 module: github.com/nanobox-io/golang-nanoauth
 versions:
-- introduced: v0.0.0-20160722212129-ac0cc4484ad4
-  fixed: v0.0.0-20200131131040-063a3fb69896
+  - introduced: v0.0.0-20160722212129-ac0cc4484ad4
+    fixed: v0.0.0-20200131131040-063a3fb69896
 description: |
   If any of the `ListenAndServe` functions are called with an empty token,
   token authentication is disabled globally for all listeners.
@@ -10,17 +10,17 @@ description: |
   very low latency and able to make a lot of requests to potentially
   recover the token.
 published: 2021-04-14T12:00:00Z
-credit: '@bouk'
+credit: "@bouk"
 symbols:
-- Auth.ServerHTTP
-- Auth.ListenAndServeTLS
-- Auth.ListenAndServe
+  - Auth.ServerHTTP
+  - Auth.ListenAndServeTLS
+  - Auth.ListenAndServe
 links:
   pr: https://github.com/nanobox-io/golang-nanoauth/pull/5
   commit: https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3
 cve_metadata:
   id: CVE-9999-0003
-  cwe: 'CWE-305: Authentication Bypass by Primary Weakness'
+  cwe: "CWE-305: Authentication Bypass by Primary Weakness"
   description: |
     Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between
     v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe

reports/GO-2020-0005.yaml

@@ -1,7 +1,7 @@
 module: go.etcd.io/etcd
 package: go.etcd.io/etcd/wal
 versions:
-- fixed: v0.5.0-alpha.5.0.20200423152442-f4b650b51dc4
+  - fixed: v0.5.0-alpha.5.0.20200423152442-f4b650b51dc4
 description: |
   Malformed WALs can be constructed such that [`WAL.ReadAll`][] can cause attempted
   out of bounds reads, or creation of arbitarily sized slices, which may be used as
@@ -10,10 +10,10 @@ published: 2021-04-14T12:00:00Z
 cve: CVE-2020-15106
 credit: Trail of Bits
 symbols:
-- WAL.ReadAll
-- decoder.decodeRecord
+  - WAL.ReadAll
+  - decoder.decodeRecord
 links:
   pr: https://github.com/etcd-io/etcd/pull/11793
   commit: https://github.com/etcd-io/etcd/commit/f4b650b51dc4a53a8700700dc12e1242ac56ba07
   context:
-  - https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf
+    - https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf

reports/GO-2020-0006.yaml

@@ -1,6 +1,6 @@
 module: github.com/miekg/dns
 versions:
-- fixed: v1.0.4-0.20180125103619-43913f2f4fbd
+  - fixed: v1.0.4-0.20180125103619-43913f2f4fbd
 description: |
   An attacker may prevent TCP connections to a [`Server`][] by opening
   a connection and leaving it idle, until the connection is closed by
@@ -9,7 +9,7 @@ published: 2021-04-14T12:00:00Z
 cve: CVE-2017-15133
 credit: Pedro Sampaio
 symbols:
-- Server.serveTCP
+  - Server.serveTCP
 links:
   pr: https://github.com/miekg/dns/pull/631
   commit: https://github.com/miekg/dns/commit/43913f2f4fbd7dcff930b8a809e709591e4dd79e

reports/GO-2020-0007.yaml

@@ -1,6 +1,6 @@
 module: github.com/seccomp/libseccomp-golang
 versions:
-- fixed: v0.9.1-0.20170424173420-06e7a29f36a3
+  - fixed: v0.9.1-0.20170424173420-06e7a29f36a3
 description: |
   Filters containing rules with multiple syscall arguments are improperly
   constructed, such that all arguments are required to match rather than
@@ -9,8 +9,8 @@ description: |
   behavior.
 published: 2021-04-14T12:00:00Z
 cve: CVE-2017-18367
-credit: '@ihac'
+credit: "@ihac"
 symbols:
-- ScmpFilter.addRuleGeneric
+  - ScmpFilter.addRuleGeneric
 links:
   commit: https://github.com/seccomp/libseccomp-golang/commit/06e7a29f36a34b8cf419aeb87b979ee508e58f9e

reports/GO-2020-0008.yaml

@@ -1,17 +1,17 @@
 module: github.com/miekg/dns
 versions:
-- fixed: v1.1.25-0.20191211073109-8ebf2e419df7
+  - fixed: v1.1.25-0.20191211073109-8ebf2e419df7
 description: |
   DNS message transaction IDs are generated using [`math/rand`] which
   makes them relatively predictable. This reduces the complexity
   of response spoofing attacks against DNS clients.
 published: 2021-04-14T12:00:00Z
 cve: CVE-2019-19794
 symbols:
-- id
+  - id
 links:
   pr: https://github.com/miekg/dns/pull/1044
   commit: https://github.com/miekg/dns/commit/8ebf2e419df7857ac8919baa05248789a8ffbf33
   context:
-  - https://github.com/miekg/dns/issues/1037
-  - https://github.com/miekg/dns/issues/1043
+    - https://github.com/miekg/dns/issues/1037
+    - https://github.com/miekg/dns/issues/1043

reports/GO-2020-0009.yaml

@@ -1,12 +1,12 @@
 module: github.com/square/go-jose
 package: github.com/square/go-jose/cipher
 additional_packages:
-- module: github.com/square/go-jose
-  symbols:
-  - JsonWebEncryption.Decrypt
-  - JsonWebEncryption.DecryptMulti
+  - module: github.com/square/go-jose
+    symbols:
+      - JsonWebEncryption.Decrypt
+      - JsonWebEncryption.DecryptMulti
 versions:
-- fixed: v0.0.0-20160903044734-789a4c4bd4c1
+  - fixed: v0.0.0-20160903044734-789a4c4bd4c1
 description: |
   On 32-bit platforms an attacker can manipulate a ciphertext encrypted with AES-CBC
   with HMAC such that they can control how large the input buffer is when computing
@@ -16,21 +16,21 @@ published: 2021-04-14T12:00:00Z
 cve: CVE-2016-9123
 credit: Quan Nguyen from Google's Information Security Engineering Team
 symbols:
-- cbcAEAD.computeAuthTag
+  - cbcAEAD.computeAuthTag
 arch:
-- "386"
-- arm
-- armbe
-- amd64p32
-- mips
-- mipsle
-- mips64p32
-- mips64p32le
-- ppc
-- riscv
-- s390
-- sparc
+  - "386"
+  - arm
+  - armbe
+  - amd64p32
+  - mips
+  - mipsle
+  - mips64p32
+  - mips64p32le
+  - ppc
+  - riscv
+  - s390
+  - sparc
 links:
   commit: https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96
   context:
-  - https://www.openwall.com/lists/oss-security/2016/11/03/1
+    - https://www.openwall.com/lists/oss-security/2016/11/03/1