Skip to content

Commit 052eac7

Browse files
zpavlinoviczpavlinovic
committed
internal/sarif: improve GOMODCACHE relative paths
The paths are now indeed relative to %GOMODCACHE%. Change-Id: I445f95dfdcda4bf053b28917482f9a39866f9dd3 Reviewed-on: https://go-review.googlesource.com/c/vuln/+/581235 Reviewed-by: Ian Cottrell <iancottrell@google.com> Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
1 parent 93d3090 commit 052eac7

File tree

2 files changed

+23
-20
lines changed

2 files changed

+23
-20
lines changed

‎cmd/govulncheck/testdata/common/testfiles/source-call/source_call_sarif.ct

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ $ govulncheck -C ${moddir}/vuln -format sarif ./...
177177
"location": {
178178
"physicalLocation": {
179179
"artifactLocation": {
180-
"uri": "gjson.go",
180+
"uri": "github.com/tidwall/gjson@v1.6.5/gjson.go",
181181
"uriBaseId": "%GOMODCACHE%"
182182
},
183183
"region": {
@@ -195,7 +195,7 @@ $ govulncheck -C ${moddir}/vuln -format sarif ./...
195195
"location": {
196196
"physicalLocation": {
197197
"artifactLocation": {
198-
"uri": "gjson.go",
198+
"uri": "github.com/tidwall/gjson@v1.6.5/gjson.go",
199199
"uriBaseId": "%GOMODCACHE%"
200200
},
201201
"region": {
@@ -213,7 +213,7 @@ $ govulncheck -C ${moddir}/vuln -format sarif ./...
213213
"location": {
214214
"physicalLocation": {
215215
"artifactLocation": {
216-
"uri": "gjson.go",
216+
"uri": "github.com/tidwall/gjson@v1.6.5/gjson.go",
217217
"uriBaseId": "%GOMODCACHE%"
218218
},
219219
"region": {
@@ -263,7 +263,7 @@ $ govulncheck -C ${moddir}/vuln -format sarif ./...
263263
"location": {
264264
"physicalLocation": {
265265
"artifactLocation": {
266-
"uri": "gjson.go",
266+
"uri": "github.com/tidwall/gjson@v1.6.5/gjson.go",
267267
"uriBaseId": "%GOMODCACHE%"
268268
},
269269
"region": {
@@ -281,7 +281,7 @@ $ govulncheck -C ${moddir}/vuln -format sarif ./...
281281
"location": {
282282
"physicalLocation": {
283283
"artifactLocation": {
284-
"uri": "gjson.go",
284+
"uri": "github.com/tidwall/gjson@v1.6.5/gjson.go",
285285
"uriBaseId": "%GOMODCACHE%"
286286
},
287287
"region": {
@@ -299,7 +299,7 @@ $ govulncheck -C ${moddir}/vuln -format sarif ./...
299299
"location": {
300300
"physicalLocation": {
301301
"artifactLocation": {
302-
"uri": "gjson.go",
302+
"uri": "github.com/tidwall/gjson@v1.6.5/gjson.go",
303303
"uriBaseId": "%GOMODCACHE%"
304304
},
305305
"region": {
@@ -317,7 +317,7 @@ $ govulncheck -C ${moddir}/vuln -format sarif ./...
317317
"location": {
318318
"physicalLocation": {
319319
"artifactLocation": {
320-
"uri": "gjson.go",
320+
"uri": "github.com/tidwall/gjson@v1.6.5/gjson.go",
321321
"uriBaseId": "%GOMODCACHE%"
322322
},
323323
"region": {
@@ -335,7 +335,7 @@ $ govulncheck -C ${moddir}/vuln -format sarif ./...
335335
"location": {
336336
"physicalLocation": {
337337
"artifactLocation": {
338-
"uri": "gjson.go",
338+
"uri": "github.com/tidwall/gjson@v1.6.5/gjson.go",
339339
"uriBaseId": "%GOMODCACHE%"
340340
},
341341
"region": {
@@ -402,7 +402,7 @@ $ govulncheck -C ${moddir}/vuln -format sarif ./...
402402
"location": {
403403
"physicalLocation": {
404404
"artifactLocation": {
405-
"uri": "language/parse.go",
405+
"uri": "golang.org/x/text@v0.3.0/language/parse.go",
406406
"uriBaseId": "%GOMODCACHE%"
407407
},
408408
"region": {
@@ -452,7 +452,7 @@ $ govulncheck -C ${moddir}/vuln -format sarif ./...
452452
"location": {
453453
"physicalLocation": {
454454
"artifactLocation": {
455-
"uri": "language/parse.go",
455+
"uri": "golang.org/x/text@v0.3.0/language/parse.go",
456456
"uriBaseId": "%GOMODCACHE%"
457457
},
458458
"region": {
@@ -519,7 +519,7 @@ $ govulncheck -C ${moddir}/vuln -format sarif ./...
519519
"location": {
520520
"physicalLocation": {
521521
"artifactLocation": {
522-
"uri": "gjson.go",
522+
"uri": "github.com/tidwall/gjson@v1.6.5/gjson.go",
523523
"uriBaseId": "%GOMODCACHE%"
524524
},
525525
"region": {
@@ -569,7 +569,7 @@ $ govulncheck -C ${moddir}/vuln -format sarif ./...
569569
"location": {
570570
"physicalLocation": {
571571
"artifactLocation": {
572-
"uri": "gjson.go",
572+
"uri": "github.com/tidwall/gjson@v1.6.5/gjson.go",
573573
"uriBaseId": "%GOMODCACHE%"
574574
},
575575
"region": {

‎internal/sarif/handler.go

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"encoding/json"
99
"fmt"
1010
"io"
11+
"path/filepath"
1112
"sort"
1213

1314
"golang.org/x/vuln/internal"
@@ -289,11 +290,12 @@ func stack(h *handler, f *govulncheck.Finding) Stack {
289290
Module: frame.Module + "@" + frame.Version,
290291
Location: Location{Message: Description{Text: symbol(frame)}}, // show the (full) symbol name
291292
}
293+
file, base := fileURIInfo(pos.Filename, top.Module, frame.Module, frame.Version)
292294
if h.cfg.ScanMode != govulncheck.ScanModeBinary {
293295
sf.Location.PhysicalLocation = PhysicalLocation{
294296
ArtifactLocation: ArtifactLocation{
295-
URI: pos.Filename,
296-
URIBaseID: uriID(top.Module, frame.Module),
297+
URI: file,
298+
URIBaseID: base,
297299
},
298300
Region: Region{
299301
StartLine: pos.Line,
@@ -362,11 +364,12 @@ func threadFlows(h *handler, fs []*govulncheck.Finding) []ThreadFlow {
362364
Module: frame.Module + "@" + frame.Version,
363365
Location: Location{Message: Description{Text: symbol(frame)}}, // show the (full) symbol name
364366
}
367+
file, base := fileURIInfo(pos.Filename, top.Module, frame.Module, frame.Version)
365368
if h.cfg.ScanMode != govulncheck.ScanModeBinary {
366369
tfl.Location.PhysicalLocation = PhysicalLocation{
367370
ArtifactLocation: ArtifactLocation{
368-
URI: pos.Filename,
369-
URIBaseID: uriID(top.Module, frame.Module),
371+
URI: file,
372+
URIBaseID: base,
370373
},
371374
Region: Region{
372375
StartLine: pos.Line,
@@ -381,12 +384,12 @@ func threadFlows(h *handler, fs []*govulncheck.Finding) []ThreadFlow {
381384
return tfs
382385
}
383386

384-
func uriID(top, module string) string {
387+
func fileURIInfo(filename, top, module, version string) (string, string) {
385388
if top == module {
386-
return SrcRootID
389+
return filename, SrcRootID
387390
}
388391
if module == internal.GoStdModulePath {
389-
return GoRootID
392+
return filename, GoRootID
390393
}
391-
return GoModCacheID
394+
return filepath.ToSlash(filepath.Join(module+"@"+version, filename)), GoModCacheID
392395
}

0 commit comments

Comments
 (0)