Skip to content

Commit c856ba8

Browse files
rolandshoemakerrolandshoemaker
committed
report,osv,client: update schema to current state
Match the current state of https://tinyurl.com/vuln-json, also fix a minor bug in deploy-db.sh. Change-Id: Ib6c225637cb538ef263b7bf182d30e36e76a43e3 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/321509 Trust: Roland Shoemaker <roland@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org>
1 parent e0c00fa commit c856ba8

File tree

5 files changed

+90
-101
lines changed

5 files changed

+90
-101
lines changed

‎client/client_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ import (
1818

1919
var testVuln1 string = `[
2020
{"ID":"ID1","Package":{"Name":"golang.org/example/one","Ecosystem":"go"}, "Summary":"",
21-
"Severity":2,"Affects":{"Ranges":[{"Type":2,"Introduced":"","Fixed":"v2.2.0"}]},
21+
"Severity":2,"Affects":{"Ranges":[{"Type":"SEMVER","Introduced":"","Fixed":"v2.2.0"}]},
2222
"ecosystem_specific":{"Symbols":["some_symbol_1"]
2323
}}]`
2424

2525
var testVuln2 string = `[
2626
{"ID":"ID2","Package":{"Name":"golang.org/example/two","Ecosystem":"go"}, "Summary":"",
27-
"Severity":2,"Affects":{"Ranges":[{"Type":2,"Introduced":"","Fixed":"v2.1.0"}]},
27+
"Severity":2,"Affects":{"Ranges":[{"Type":"SEMVER","Introduced":"","Fixed":"v2.1.0"}]},
2828
"ecosystem_specific":{"Symbols":["some_symbol_2"]
2929
}}]`
3030

‎deploy-db.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22
tmp_dir=$(mktemp -d -t vulndb-XXXX)
33
go run ./cmd/gendb -reports reports -out $tmp_dir
44
cd $tmp_dir
5-
gsutil cp -m -r . gs://go-vulndb
5+
gsutil -m cp -r . gs://go-vulndb
66
cd -
7-
rm -rf $tmp_dir
7+
rm -rf $tmp_dir

‎osv/json.go‎

Lines changed: 32 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -34,27 +34,27 @@ import (
3434
// vulndb implementatiion detail.
3535
type DBIndex map[string]time.Time
3636

37-
type AffectsRangeType int
37+
type AffectsRangeType string
3838

3939
const (
40-
TypeUnspecified AffectsRangeType = iota
41-
TypeGit
42-
TypeSemver
40+
TypeUnspecified AffectsRangeType = "UNSPECIFIED"
41+
TypeGit AffectsRangeType = "GIT"
42+
TypeSemver AffectsRangeType = "SEMVER"
4343
)
4444

4545
type Ecosystem string
4646

47-
const GoEcosystem Ecosystem = "go"
47+
const GoEcosystem Ecosystem = "Go"
4848

4949
type Package struct {
50-
Name string
51-
Ecosystem Ecosystem
50+
Name string `json:"name"`
51+
Ecosystem Ecosystem `json:"ecosystem"`
5252
}
5353

5454
type AffectsRange struct {
55-
Type AffectsRangeType
56-
Introduced string
57-
Fixed string
55+
Type AffectsRangeType `json:"type"`
56+
Introduced string `json:"introduced"`
57+
Fixed string `json:"fixed"`
5858
}
5959

6060
func (ar AffectsRange) containsSemver(v string) bool {
@@ -108,29 +108,27 @@ type GoSpecific struct {
108108
Symbols []string `json:",omitempty"`
109109
GOOS []string `json:",omitempty"`
110110
GOARCH []string `json:",omitempty"`
111-
URL string
111+
URL string `json:"url"`
112112
}
113113

114114
type Reference struct {
115-
Type string
116-
URL string
115+
Type string `json:"type"`
116+
URL string `json:"url"`
117117
}
118118

119119
// Entry represents a OSV style JSON vulnerability database
120120
// entry
121121
type Entry struct {
122-
ID string
123-
Published time.Time
124-
Modified time.Time
125-
Withdrawn *time.Time `json:",omitempty"`
126-
Aliases []string `json:",omitempty"`
127-
Package Package
128-
Details string
129-
Affects Affects
130-
References []Reference `json:",omitempty"`
131-
Extra struct {
132-
Go GoSpecific
133-
}
122+
ID string `json:"id"`
123+
Published time.Time `json:"published"`
124+
Modified time.Time `json:"modified"`
125+
Withdrawn *time.Time `json:"withdrawn,omitempty"`
126+
Aliases []string `json:"aliases,omitempty"`
127+
Package Package `json:"package"`
128+
Details string `json:"details"`
129+
Affects Affects `json:"affects"`
130+
References []Reference `json:"references,omitempty"`
131+
EcosystemSpecific GoSpecific `json:"ecosystem_specific"`
134132
}
135133

136134
func Generate(id string, url string, r report.Report) []Entry {
@@ -153,24 +151,22 @@ func Generate(id string, url string, r report.Report) []Entry {
153151
},
154152
Details: r.Description,
155153
Affects: generateAffects(r.Versions),
156-
Extra: struct{ Go GoSpecific }{
157-
Go: GoSpecific{
158-
Symbols: r.Symbols,
159-
GOOS: r.OS,
160-
GOARCH: r.Arch,
161-
URL: url,
162-
},
154+
EcosystemSpecific: GoSpecific{
155+
Symbols: r.Symbols,
156+
GOOS: r.OS,
157+
GOARCH: r.Arch,
158+
URL: url,
163159
},
164160
}
165161

166162
if r.Links.PR != "" {
167-
entry.References = append(entry.References, Reference{Type: "code review", URL: r.Links.PR})
163+
entry.References = append(entry.References, Reference{Type: "FIX", URL: r.Links.PR})
168164
}
169165
if r.Links.Commit != "" {
170-
entry.References = append(entry.References, Reference{Type: "fix", URL: r.Links.Commit})
166+
entry.References = append(entry.References, Reference{Type: "FIX", URL: r.Links.Commit})
171167
}
172168
for _, link := range r.Links.Context {
173-
entry.References = append(entry.References, Reference{Type: "misc", URL: link})
169+
entry.References = append(entry.References, Reference{Type: "WEB", URL: link})
174170
}
175171

176172
if r.CVE != "" {
@@ -187,7 +183,7 @@ func Generate(id string, url string, r report.Report) []Entry {
187183
additionalImportPath = additional.Package
188184
}
189185
entryCopy.Package.Name = additionalImportPath
190-
entryCopy.Extra.Go.Symbols = additional.Symbols
186+
entryCopy.EcosystemSpecific.Symbols = additional.Symbols
191187
entryCopy.Affects = generateAffects(additional.Versions)
192188

193189
entries = append(entries, entryCopy)

‎osv/json_test.go‎

Lines changed: 22 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,7 @@ import (
1515
func TestGenerate(t *testing.T) {
1616
r := report.Report{
1717
Module: "example.com/vulnerable/v2",
18-
AdditionalPackages: []struct {
19-
Module string
20-
Package string
21-
Symbols []string
22-
Versions []report.VersionRange
23-
}{
18+
AdditionalPackages: []report.Additional{
2419
{
2520
Module: "vanity.host/vulnerable",
2621
Package: "vanity.host/vulnerable/package",
@@ -43,11 +38,7 @@ func TestGenerate(t *testing.T) {
4338
Symbols: []string{"A", "B.b"},
4439
OS: []string{"windows"},
4540
Arch: []string{"arm64"},
46-
Links: struct {
47-
PR string
48-
Commit string
49-
Context []string
50-
}{
41+
Links: report.Links{
5142
PR: "pr",
5243
Commit: "commit",
5344
Context: []string{"issue-a", "issue-b"},
@@ -59,7 +50,7 @@ func TestGenerate(t *testing.T) {
5950
ID: "GO-1991-0001",
6051
Package: Package{
6152
Name: "example.com/vulnerable/v2",
62-
Ecosystem: "go",
53+
Ecosystem: "Go",
6354
},
6455
Details: "It's a real bad one, I'll tell you that",
6556
Affects: Affects{
@@ -80,27 +71,25 @@ func TestGenerate(t *testing.T) {
8071
},
8172
},
8273
References: []Reference{
83-
Reference{Type: "code review", URL: "pr"},
84-
Reference{Type: "fix", URL: "commit"},
85-
Reference{Type: "misc", URL: "issue-a"},
86-
Reference{Type: "misc", URL: "issue-b"},
74+
Reference{Type: "FIX", URL: "pr"},
75+
Reference{Type: "FIX", URL: "commit"},
76+
Reference{Type: "WEB", URL: "issue-a"},
77+
Reference{Type: "WEB", URL: "issue-b"},
8778
},
8879
Aliases: []string{"CVE-0000-0000"},
89-
Extra: struct{ Go GoSpecific }{
90-
Go: GoSpecific{
91-
Symbols: []string{"A", "B.b"},
92-
GOOS: []string{"windows"},
93-
GOARCH: []string{"arm64"},
94-
URL: "https://vulns.golang.org/GO-1991-0001.html",
95-
},
80+
EcosystemSpecific: GoSpecific{
81+
Symbols: []string{"A", "B.b"},
82+
GOOS: []string{"windows"},
83+
GOARCH: []string{"arm64"},
84+
URL: "https://vulns.golang.org/GO-1991-0001.html",
9685
},
9786
},
9887
{
9988

10089
ID: "GO-1991-0001",
10190
Package: Package{
10291
Name: "vanity.host/vulnerable/package",
103-
Ecosystem: "go",
92+
Ecosystem: "Go",
10493
},
10594
Details: "It's a real bad one, I'll tell you that",
10695
Affects: Affects{
@@ -121,19 +110,17 @@ func TestGenerate(t *testing.T) {
121110
},
122111
},
123112
References: []Reference{
124-
Reference{Type: "code review", URL: "pr"},
125-
Reference{Type: "fix", URL: "commit"},
126-
Reference{Type: "misc", URL: "issue-a"},
127-
Reference{Type: "misc", URL: "issue-b"},
113+
Reference{Type: "FIX", URL: "pr"},
114+
Reference{Type: "FIX", URL: "commit"},
115+
Reference{Type: "WEB", URL: "issue-a"},
116+
Reference{Type: "WEB", URL: "issue-b"},
128117
},
129118
Aliases: []string{"CVE-0000-0000"},
130-
Extra: struct{ Go GoSpecific }{
131-
Go: GoSpecific{
132-
Symbols: []string{"b", "A.b"},
133-
GOOS: []string{"windows"},
134-
GOARCH: []string{"arm64"},
135-
URL: "https://vulns.golang.org/GO-1991-0001.html",
136-
},
119+
EcosystemSpecific: GoSpecific{
120+
Symbols: []string{"b", "A.b"},
121+
GOOS: []string{"windows"},
122+
GOARCH: []string{"arm64"},
123+
URL: "https://vulns.golang.org/GO-1991-0001.html",
137124
},
138125
},
139126
}

‎report/report.go‎

Lines changed: 32 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,25 @@ type VersionRange struct {
1111
Fixed string `yaml:",omitempty"`
1212
}
1313

14+
type Additional struct {
15+
Module string `yaml:",omitempty"`
16+
Package string `yaml:",omitempty"`
17+
Symbols []string `yaml:",omitempty"`
18+
Versions []VersionRange `yaml:",omitempty"`
19+
}
20+
21+
type Links struct {
22+
PR string `yaml:",omitempty"`
23+
Commit string `yaml:",omitempty"`
24+
Context []string `yaml:",omitempty"`
25+
}
26+
27+
type CVEMeta struct {
28+
ID string `yaml:",omitempty"`
29+
CWE string `yaml:",omitempty"`
30+
Description string `yaml:",omitempty"`
31+
}
32+
1433
type Report struct {
1534
Module string `yaml:",omitempty"`
1635
Package string `yaml:",omitempty"`
@@ -26,30 +45,17 @@ type Report struct {
2645
// really be replaced with 'aliases', we'll still need
2746
// additional packages for some cases, but it's too heavy
2847
// for most
29-
AdditionalPackages []struct {
30-
Module string `yaml:",omitempty"`
31-
Package string `yaml:",omitempty"`
32-
Symbols []string `yaml:",omitempty"`
33-
Versions []VersionRange `yaml:",omitempty"`
34-
} `yaml:"additional_packages,omitempty"`
35-
Versions []VersionRange `yaml:",omitempty"`
36-
Description string `yaml:",omitempty"`
37-
Published time.Time `yaml:",omitempty"`
38-
LastModified *time.Time `yaml:"last_modified,omitempty"`
39-
Withdrawn *time.Time `yaml:",omitempty"`
40-
CVE string `yaml:",omitempty"`
41-
Credit string `yaml:",omitempty"`
42-
Symbols []string `yaml:",omitempty"`
43-
OS []string `yaml:",omitempty"`
44-
Arch []string `yaml:",omitempty"`
45-
Links struct {
46-
PR string `yaml:",omitempty"`
47-
Commit string `yaml:",omitempty"`
48-
Context []string `yaml:",omitempty"`
49-
} `yaml:",omitempty"`
50-
CVEMetadata *struct {
51-
ID string `yaml:",omitempty"`
52-
CWE string `yaml:",omitempty"`
53-
Description string `yaml:",omitempty"`
54-
} `yaml:"cve_metadata,omitempty"`
48+
AdditionalPackages []Additional `yaml:"additional_packages,omitempty"`
49+
Versions []VersionRange `yaml:",omitempty"`
50+
Description string `yaml:",omitempty"`
51+
Published time.Time `yaml:",omitempty"`
52+
LastModified *time.Time `yaml:"last_modified,omitempty"`
53+
Withdrawn *time.Time `yaml:",omitempty"`
54+
CVE string `yaml:",omitempty"`
55+
Credit string `yaml:",omitempty"`
56+
Symbols []string `yaml:",omitempty"`
57+
OS []string `yaml:",omitempty"`
58+
Arch []string `yaml:",omitempty"`
59+
Links Links `yaml:",omitempty"`
60+
CVEMetadata *CVEMeta `yaml:"cve_metadata,omitempty"`
5561
}

0 commit comments

Comments
 (0)