Skip to content

Commit 8cef5ae

Browse files
hyangahhyangah
committed
media/vulncheckView: organize unaffecting vulns by vuln ids
This matches the latest govulncheck's behavior. With this change, we can also present the details about each unaffecting vulnerability and fixes. gopls vulncheck (v0.9.5) yet doesn't provide package names and currently used version info for unaffecting vulnerabilities. Once that is fixed in gopls, we can make the unaffecting vulnerability section more like the main, known vulnerability section. Change-Id: Ifb9bc7272346c4c78606feeea165f485d60b9cf6 Reviewed-on: https://go-review.googlesource.com/c/vscode-go/+/429236 Reviewed-by: Jamal Carvalho <jamal@golang.org> TryBot-Result: kokoro <noreply+kokoro@google.com> Run-TryBot: Hyang-Ah Hana Kim <hyangah@gmail.com>
1 parent 4b658d3 commit 8cef5ae

File tree

3 files changed

+76
-18
lines changed

3 files changed

+76
-18
lines changed

‎media/vulncheckView.css‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,10 @@
33
* Licensed under the MIT License. See LICENSE in the project root for license information.
44
*--------------------------------------------------------*/
55

6-
.log {
6+
.log,
7+
.info {
78
font-weight: lighter;
9+
padding-bottom: 1em;
810
}
911

1012
.vuln {

‎media/vulncheckView.js‎

Lines changed: 71 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,32 @@
3636
errorContainer.className = 'error'
3737
errorContainer.style.display = 'none'
3838

39-
function moduleVersion(/** @type {string} */mod, /** @type {string|undefined} */ver) {
40-
if (ver) {
41-
return `<a href="https://pkg.go.dev/${mod}@${ver}">${mod}@${ver}</a>`;
39+
function packageVersion(/** @type {string} */mod, /** @type {string} */pkg, /** @type {string|undefined} */ver) {
40+
if (!ver) {
41+
return 'N/A';
4242
}
43-
return 'N/A'
43+
44+
if (mod === 'stdlib' && ver.startsWith('v')) {
45+
ver = `go${ver.slice(1)}`;
46+
}
47+
return `<a href="https://pkg.go.dev/${pkg}@${ver}">${pkg}@${ver}</a>`;
48+
}
49+
50+
function modVersion(/** @type {string} */mod, /** @type {string|undefined} */ver) {
51+
if (!ver) {
52+
return 'N/A';
53+
}
54+
55+
if (mod === 'stdlib' && ver.startsWith('v')) {
56+
ver = `go${ver.slice(1)}`;
57+
}
58+
return `<a href="https://pkg.go.dev/${mod}@${ver}">${mod}@${ver}</a>`;
4459
}
4560

4661
function offerUpgrade(/** @type {string} */dir, /** @type {string} */mod, /** @type {string|undefined} */ver) {
62+
if (mod === 'stdlib') {
63+
return '';
64+
}
4765
if (dir && mod && ver) {
4866
return ` [<span class="vuln-fix" data-target="${mod}@${ver}" data-dir="${dir}">go get</span> | <span class="vuln-fix" data-target="${mod}@latest" data-dir="${dir}">go get latest</span>]`
4967
}
@@ -83,12 +101,16 @@
83101
const vulns = json.Vuln || [];
84102
const affecting = vulns.filter((v) => v.CallStackSummaries?.length);
85103
const unaffecting = vulns.filter((v) => !v.CallStackSummaries?.length);
86-
104+
87105
runLog.innerHTML = `
88106
<tr><td>Dir:</td><td>${json.Dir || ''}</td></tr>
89107
<tr><td>Pattern:</td><td>${json.Pattern || ''}</td></tr>
90108
<tr><td>Analyzed at:</td><td>${timeinfo(json.Start, json.Duration)}</td></tr>
91-
<tr><td>Found ${affecting?.length || 0} known vulnerabilities</td></tr>`;
109+
<tr><td>Found</td><td>${affecting?.length || 0} known vulnerabilities</td></tr>`;
110+
if (unaffecting?.length > 0) {
111+
runLog.innerHTML += `<tr><td>Found</td><td>${unaffecting.length} informational vulnerabilities</td></tr>`
112+
}
113+
92114
logContainer.appendChild(runLog);
93115

94116
vulnsContainer.innerHTML = '';
@@ -114,8 +136,8 @@
114136
details.className = 'vuln-details'
115137
details.innerHTML = `
116138
<tr><td>Package</td><td>${vuln.PkgPath}</td></tr>
117-
<tr><td>Found in Version</td><td>${moduleVersion(vuln.ModPath, vuln.CurrentVersion)}</td></tr>
118-
<tr><td>Fixed Version</td><td>${moduleVersion(vuln.ModPath, vuln.FixedVersion)} ${offerUpgrade(json.Dir, vuln.ModPath, vuln.FixedVersion)}</td></tr>
139+
<tr><td>Found in Version</td><td>${packageVersion(vuln.ModPath, vuln.PkgPath, vuln.CurrentVersion)}</td></tr>
140+
<tr><td>Fixed Version</td><td>${packageVersion(vuln.ModPath, vuln.PkgPath, vuln.FixedVersion)} ${offerUpgrade(json.Dir, vuln.ModPath, vuln.FixedVersion)}</td></tr>
119141
<tr><td>Affecting</td><td>${vuln.AffectedPkgs?.join('<br>')}</td></tr>
120142
`;
121143
element.appendChild(details);
@@ -156,16 +178,50 @@
156178

157179
unaffectingContainer.innerText = '';
158180
if (unaffecting.length > 0) {
159-
unaffectingContainer.innerHTML = '<hr></hr><p>The vulnerabilities below are in packages that you import, but your code does not appear to call any vulnerable functions. You may not need to take any action. See <a href="https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck">https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck</a> for details.';
181+
const notice = document.createElement('div');
182+
notice.className = 'info';
183+
notice.innerHTML = `
184+
<hr></hr>The vulnerabilities below are in packages that you import,
185+
but your code does not appear to call any vulnerable functions.
186+
You may not need to take any action. See
187+
<a href="https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck">
188+
https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck</a>
189+
for details.
190+
`;
191+
192+
unaffectingContainer.appendChild(notice);
160193

161-
const details = document.createElement('table');
162194
unaffecting.forEach((vuln) => {
163-
const row = document.createElement('tr');
164-
row.className = 'vuln-details'
165-
row.innerHTML = `<tr><td>${vuln.ModPath}</td><td><a href="${vuln.URL}">${vuln.ID}</a></td></tr>`;
166-
details.appendChild(row);
195+
const element = document.createElement('div');
196+
element.className = 'vuln';
197+
unaffectingContainer.appendChild(element);
198+
199+
// TITLE - Vuln ID
200+
const title = document.createElement('h2');
201+
title.innerHTML = `<a href="${vuln.URL}">${vuln.ID}</a>`;
202+
title.className = 'vuln-title';
203+
element.appendChild(title);
204+
205+
// DESCRIPTION - short text (aliases)
206+
const desc = document.createElement('p');
207+
desc.innerHTML = Array.isArray(vuln.Aliases) && vuln.Aliases.length ? `${vuln.Details} (${vuln.Aliases.join(', ')})` : vuln.Details;
208+
desc.className = 'vuln-desc';
209+
element.appendChild(desc);
210+
211+
// DETAILS - dump of all details
212+
// TODO(hyangah):
213+
// - include the current version & package name when gopls provides them.
214+
// - offer upgrade like affect vulnerabilities. We will need to install another event listener
215+
// on unaffectingContainer. See vulnsContainer.addEventListener.
216+
const details = document.createElement('table');
217+
details.className = 'vuln-details'
218+
if (vuln.FixedVersion) {
219+
details.innerHTML = `<tr><td>Fixed Version</td><td>${modVersion(vuln.ModPath, vuln.FixedVersion)}</td></tr>`;
220+
} else {
221+
details.innerHTML = `<tr><td>Fixed Version</td><td>unavailable for ${vuln.ModPath}</td></tr>`;
222+
}
223+
element.appendChild(details);
167224
});
168-
unaffectingContainer.appendChild(details);
169225
}
170226
}
171227

‎test/gopls/vulncheck.test.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,15 +59,15 @@ suite('vulncheck result viewer tests', () => {
5959
const { log = '', vulns = '', unaffecting = '' } = JSON.parse(res.target ?? '{}');
6060

6161
assert(
62-
log.includes('Found 1 known vulnerabilities'),
62+
log.includes('1 known vulnerabilities'),
6363
`expected "1 known vulnerabilities", got ${JSON.stringify(res.target)}`
6464
);
6565
assert(
6666
vulns.includes('GO-2021-0113') &&
6767
vulns.includes('<td>Affecting</td><td>github.com/golang/vscode-go/test/testdata/vuln</td>'),
6868
`expected "Affecting" section, got ${JSON.stringify(res.target)}`
6969
);
70-
// Unaffecting vulnerability's detail is omitted, but its ID is reported.
70+
// Unaffecting vulnerability's ID is reported.
7171
assert(
7272
unaffecting.includes('GO-2021-0000') && unaffecting.includes('golang.org/x/text'),
7373
`expected reports about unaffecting vulns, got ${JSON.stringify(res.target)}`

0 commit comments

Comments
 (0)