Skip to content

Commit 5507063

Browse files
zpavlinoviczpavlinovic
committed
cmd/govulncheck: mask line numbers and columns
These can in principle change for stdlib. Although we always pretend we are running against go1.18, the actual stdlib underneath can be different. This could result in different line numbers and columns. There currently does not exist a clean way of masking line position for stdlib paths, so we mask everything with placeholders. Change-Id: I08628acbf10aa3f36b969bac5745ae3b4d52f284 Reviewed-on: https://go-review.googlesource.com/c/vuln/+/562215 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Maceo Thompson <maceothompson@google.com> Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
1 parent c154f6a commit 5507063

12 files changed

+121
-104
lines changed

‎cmd/govulncheck/main_test.go

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,23 @@ var fixups = []fixup{
5151
s := string(b)
5252
return []byte(fmt.Sprintf(`.../%s%c`, filepath.Base(s[:len(s)-1]), s[len(s)-1]))
5353
},
54+
}, {
55+
// modifies position lines to mask actual line and column with <l> and
56+
// <c> placeholders, resp.
57+
pattern: `\.go:(\d+):(\d+):`,
58+
replace: `.go:<l>:<c>:`,
59+
}, {
60+
// modify position lines in json
61+
pattern: `\"line\":(\s)*(\d+)`,
62+
replace: `"line": <l>`,
63+
}, {
64+
// modify position columns in json
65+
pattern: `\"column\":(\s)*(\d+)`,
66+
replace: `"column": <c>`,
67+
}, {
68+
// modify position offset in json
69+
pattern: `\"offset\":(\s)*(\d+)`,
70+
replace: `"offset": <o>`,
5471
}, {
5572
// There was a one-line change in container/heap/heap.go between 1.18
5673
// and 1.19 that makes the stack traces different. Ignore it.

‎cmd/govulncheck/testdata/testfiles/convert/convert_text.ct

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Vulnerability #1: GO-2021-0265
1414
Found in: github.com/tidwall/gjson@v1.6.5
1515
Fixed in: github.com/tidwall/gjson@v1.9.3
1616
Example traces found:
17-
#1: .../vuln.go:14:20: vuln.main calls gjson.Result.Get
17+
#1: .../vuln.go:<l>:<c>: vuln.main calls gjson.Result.Get
1818

1919
Vulnerability #2: GO-2021-0113
2020
Due to improper index calculation, an incorrectly formatted language tag can
@@ -26,7 +26,7 @@ Vulnerability #2: GO-2021-0113
2626
Found in: golang.org/x/text@v0.3.0
2727
Fixed in: golang.org/x/text@v0.3.7
2828
Example traces found:
29-
#1: .../vuln.go:13:16: vuln.main calls language.Parse
29+
#1: .../vuln.go:<l>:<c>: vuln.main calls language.Parse
3030

3131
Your code is affected by 2 vulnerabilities from 2 modules.
3232
This scan also found 1 vulnerability in packages you import and 0

‎cmd/govulncheck/testdata/testfiles/source-call/source_call_json.ct

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -252,9 +252,9 @@ $ govulncheck -C ${moddir}/vuln -json ./...
252252
"receiver": "Result",
253253
"position": {
254254
"filename": ".../gjson.go",
255-
"offset": 5744,
256-
"line": 296,
257-
"column": 17
255+
"offset": <o>,
256+
"line": <l>,
257+
"column": <c>
258258
}
259259
},
260260
{
@@ -263,9 +263,9 @@ $ govulncheck -C ${moddir}/vuln -json ./...
263263
"function": "main",
264264
"position": {
265265
"filename": ".../vuln.go",
266-
"offset": 183,
267-
"line": 14,
268-
"column": 20
266+
"offset": <o>,
267+
"line": <l>,
268+
"column": <c>
269269
}
270270
}
271271
]
@@ -373,9 +373,9 @@ $ govulncheck -C ${moddir}/vuln -json ./...
373373
"function": "Parse",
374374
"position": {
375375
"filename": ".../parse.go",
376-
"offset": 5808,
377-
"line": 228,
378-
"column": 6
376+
"offset": <o>,
377+
"line": <l>,
378+
"column": <c>
379379
}
380380
},
381381
{
@@ -384,9 +384,9 @@ $ govulncheck -C ${moddir}/vuln -json ./...
384384
"function": "main",
385385
"position": {
386386
"filename": ".../vuln.go",
387-
"offset": 159,
388-
"line": 13,
389-
"column": 16
387+
"offset": <o>,
388+
"line": <l>,
389+
"column": <c>
390390
}
391391
}
392392
]
@@ -493,9 +493,9 @@ $ govulncheck -C ${moddir}/vuln -json ./...
493493
"receiver": "Result",
494494
"position": {
495495
"filename": ".../gjson.go",
496-
"offset": 4415,
497-
"line": 220,
498-
"column": 17
496+
"offset": <o>,
497+
"line": <l>,
498+
"column": <c>
499499
}
500500
},
501501
{
@@ -505,9 +505,9 @@ $ govulncheck -C ${moddir}/vuln -json ./...
505505
"function": "modPretty",
506506
"position": {
507507
"filename": ".../gjson.go",
508-
"offset": 53718,
509-
"line": 2631,
510-
"column": 21
508+
"offset": <o>,
509+
"line": <l>,
510+
"column": <c>
511511
}
512512
},
513513
{
@@ -517,9 +517,9 @@ $ govulncheck -C ${moddir}/vuln -json ./...
517517
"function": "execModifier",
518518
"position": {
519519
"filename": ".../gjson.go",
520-
"offset": 52543,
521-
"line": 2587,
522-
"column": 21
520+
"offset": <o>,
521+
"line": <l>,
522+
"column": <c>
523523
}
524524
},
525525
{
@@ -529,9 +529,9 @@ $ govulncheck -C ${moddir}/vuln -json ./...
529529
"function": "Get",
530530
"position": {
531531
"filename": ".../gjson.go",
532-
"offset": 38077,
533-
"line": 1881,
534-
"column": 36
532+
"offset": <o>,
533+
"line": <l>,
534+
"column": <c>
535535
}
536536
},
537537
{
@@ -542,9 +542,9 @@ $ govulncheck -C ${moddir}/vuln -json ./...
542542
"receiver": "Result",
543543
"position": {
544544
"filename": ".../gjson.go",
545-
"offset": 5781,
546-
"line": 297,
547-
"column": 12
545+
"offset": <o>,
546+
"line": <l>,
547+
"column": <c>
548548
}
549549
},
550550
{
@@ -553,9 +553,9 @@ $ govulncheck -C ${moddir}/vuln -json ./...
553553
"function": "main",
554554
"position": {
555555
"filename": ".../vuln.go",
556-
"offset": 183,
557-
"line": 14,
558-
"column": 20
556+
"offset": <o>,
557+
"line": <l>,
558+
"column": <c>
559559
}
560560
}
561561
]

‎cmd/govulncheck/testdata/testfiles/source-call/source_call_text.ct

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ Vulnerability #1: GO-2021-0265
1313
Found in: github.com/tidwall/gjson@v1.6.5
1414
Fixed in: github.com/tidwall/gjson@v1.9.3
1515
Example traces found:
16-
#1: .../vuln.go:14:20: vuln.main calls gjson.Result.Get
16+
#1: .../vuln.go:<l>:<c>: vuln.main calls gjson.Result.Get
1717

1818
Vulnerability #2: GO-2021-0113
1919
Due to improper index calculation, an incorrectly formatted language tag can
@@ -25,7 +25,7 @@ Vulnerability #2: GO-2021-0113
2525
Found in: golang.org/x/text@v0.3.0
2626
Fixed in: golang.org/x/text@v0.3.7
2727
Example traces found:
28-
#1: .../vuln.go:13:16: vuln.main calls language.Parse
28+
#1: .../vuln.go:<l>:<c>: vuln.main calls language.Parse
2929

3030
Vulnerability #3: GO-2021-0054
3131
Due to improper bounds checking, maliciously crafted JSON objects can cause
@@ -36,7 +36,7 @@ Vulnerability #3: GO-2021-0054
3636
Found in: github.com/tidwall/gjson@v1.6.5
3737
Fixed in: github.com/tidwall/gjson@v1.6.6
3838
Example traces found:
39-
#1: .../vuln.go:14:20: vuln.main calls gjson.Result.Get, which eventually calls gjson.Result.ForEach
39+
#1: .../vuln.go:<l>:<c>: vuln.main calls gjson.Result.Get, which eventually calls gjson.Result.ForEach
4040

4141
Your code is affected by 3 vulnerabilities from 2 modules.
4242
This scan also found 0 vulnerabilities in packages you import and 2
@@ -60,8 +60,8 @@ Vulnerability #1: GO-2021-0265
6060
Fixed in: github.com/tidwall/gjson@v1.9.3
6161
Example traces found:
6262
#1: for function github.com/tidwall/gjson.Result.Get
63-
.../vuln.go:14:20: golang.org/vuln.main
64-
.../gjson.go:296:17: github.com/tidwall/gjson.Result.Get
63+
.../vuln.go:<l>:<c>: golang.org/vuln.main
64+
.../gjson.go:<l>:<c>: github.com/tidwall/gjson.Result.Get
6565

6666
Vulnerability #2: GO-2021-0113
6767
Due to improper index calculation, an incorrectly formatted language tag can
@@ -74,8 +74,8 @@ Vulnerability #2: GO-2021-0113
7474
Fixed in: golang.org/x/text@v0.3.7
7575
Example traces found:
7676
#1: for function golang.org/x/text/language.Parse
77-
.../vuln.go:13:16: golang.org/vuln.main
78-
.../parse.go:228:6: golang.org/x/text/language.Parse
77+
.../vuln.go:<l>:<c>: golang.org/vuln.main
78+
.../parse.go:<l>:<c>: golang.org/x/text/language.Parse
7979

8080
Vulnerability #3: GO-2021-0054
8181
Due to improper bounds checking, maliciously crafted JSON objects can cause
@@ -87,12 +87,12 @@ Vulnerability #3: GO-2021-0054
8787
Fixed in: github.com/tidwall/gjson@v1.6.6
8888
Example traces found:
8989
#1: for function github.com/tidwall/gjson.Result.ForEach
90-
.../vuln.go:14:20: golang.org/vuln.main
91-
.../gjson.go:297:12: github.com/tidwall/gjson.Result.Get
92-
.../gjson.go:1881:36: github.com/tidwall/gjson.Get
93-
.../gjson.go:2587:21: github.com/tidwall/gjson.execModifier
94-
.../gjson.go:2631:21: github.com/tidwall/gjson.modPretty
95-
.../gjson.go:220:17: github.com/tidwall/gjson.Result.ForEach
90+
.../vuln.go:<l>:<c>: golang.org/vuln.main
91+
.../gjson.go:<l>:<c>: github.com/tidwall/gjson.Result.Get
92+
.../gjson.go:<l>:<c>: github.com/tidwall/gjson.Get
93+
.../gjson.go:<l>:<c>: github.com/tidwall/gjson.execModifier
94+
.../gjson.go:<l>:<c>: github.com/tidwall/gjson.modPretty
95+
.../gjson.go:<l>:<c>: github.com/tidwall/gjson.Result.ForEach
9696

9797
Your code is affected by 3 vulnerabilities from 2 modules.
9898
This scan also found 0 vulnerabilities in packages you import and 2
@@ -115,7 +115,7 @@ Vulnerability #1: GO-2021-0265
115115
Found in: github.com/tidwall/gjson@v1.6.5
116116
Fixed in: github.com/tidwall/gjson@v1.9.3
117117
Example traces found:
118-
#1: .../vuln.go:14:20: vuln.main calls gjson.Result.Get
118+
#1: .../vuln.go:<l>:<c>: vuln.main calls gjson.Result.Get
119119

120120
Vulnerability #2: GO-2021-0113
121121
Due to improper index calculation, an incorrectly formatted language tag can
@@ -127,7 +127,7 @@ Vulnerability #2: GO-2021-0113
127127
Found in: golang.org/x/text@v0.3.0
128128
Fixed in: golang.org/x/text@v0.3.7
129129
Example traces found:
130-
#1: .../vuln.go:13:16: vuln.main calls language.Parse
130+
#1: .../vuln.go:<l>:<c>: vuln.main calls language.Parse
131131

132132
Vulnerability #3: GO-2021-0054
133133
Due to improper bounds checking, maliciously crafted JSON objects can cause
@@ -138,7 +138,7 @@ Vulnerability #3: GO-2021-0054
138138
Found in: github.com/tidwall/gjson@v1.6.5
139139
Fixed in: github.com/tidwall/gjson@v1.6.6
140140
Example traces found:
141-
#1: .../vuln.go:14:20: vuln.main calls gjson.Result.Get, which eventually calls gjson.Result.ForEach
141+
#1: .../vuln.go:<l>:<c>: vuln.main calls gjson.Result.Get, which eventually calls gjson.Result.ForEach
142142

143143
=== Package Results ===
144144

‎cmd/govulncheck/testdata/testfiles/source-call/source_multientry_json.ct

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -243,9 +243,9 @@ $ govulncheck -json -C ${moddir}/multientry .
243243
"function": "MustParse",
244244
"position": {
245245
"filename": ".../tags.go",
246-
"offset": 427,
247-
"line": 13,
248-
"column": 6
246+
"offset": <o>,
247+
"line": <l>,
248+
"column": <c>
249249
}
250250
},
251251
{
@@ -254,9 +254,9 @@ $ govulncheck -json -C ${moddir}/multientry .
254254
"function": "foobar",
255255
"position": {
256256
"filename": ".../main.go",
257-
"offset": 1694,
258-
"line": 99,
259-
"column": 20
257+
"offset": <o>,
258+
"line": <l>,
259+
"column": <c>
260260
}
261261
},
262262
{
@@ -265,9 +265,9 @@ $ govulncheck -json -C ${moddir}/multientry .
265265
"function": "D",
266266
"position": {
267267
"filename": ".../main.go",
268-
"offset": 705,
269-
"line": 48,
270-
"column": 8
268+
"offset": <o>,
269+
"line": <l>,
270+
"column": <c>
271271
}
272272
},
273273
{
@@ -276,9 +276,9 @@ $ govulncheck -json -C ${moddir}/multientry .
276276
"function": "main",
277277
"position": {
278278
"filename": ".../main.go",
279-
"offset": 441,
280-
"line": 26,
281-
"column": 3
279+
"offset": <o>,
280+
"line": <l>,
281+
"column": <c>
282282
}
283283
}
284284
]
@@ -296,9 +296,9 @@ $ govulncheck -json -C ${moddir}/multientry .
296296
"function": "Parse",
297297
"position": {
298298
"filename": ".../parse.go",
299-
"offset": 1121,
300-
"line": 33,
301-
"column": 6
299+
"offset": <o>,
300+
"line": <l>,
301+
"column": <c>
302302
}
303303
},
304304
{
@@ -307,9 +307,9 @@ $ govulncheck -json -C ${moddir}/multientry .
307307
"function": "C",
308308
"position": {
309309
"filename": ".../main.go",
310-
"offset": 679,
311-
"line": 44,
312-
"column": 23
310+
"offset": <o>,
311+
"line": <l>,
312+
"column": <c>
313313
}
314314
},
315315
{
@@ -318,9 +318,9 @@ $ govulncheck -json -C ${moddir}/multientry .
318318
"function": "main",
319319
"position": {
320320
"filename": ".../main.go",
321-
"offset": 340,
322-
"line": 22,
323-
"column": 3
321+
"offset": <o>,
322+
"line": <l>,
323+
"column": <c>
324324
}
325325
}
326326
]

‎cmd/govulncheck/testdata/testfiles/source-call/source_multientry_text.ct

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ Vulnerability #1: GO-2021-0113
1515
Found in: golang.org/x/text@v0.3.5
1616
Fixed in: golang.org/x/text@v0.3.7
1717
Example traces found:
18-
#1: .../main.go:99:20: multientry.foobar calls language.MustParse
19-
#2: .../main.go:44:23: multientry.C calls language.Parse
18+
#1: .../main.go:<l>:<c>: multientry.foobar calls language.MustParse
19+
#2: .../main.go:<l>:<c>: multientry.C calls language.Parse
2020

2121
Your code is affected by 1 vulnerability from 1 module.
2222
This scan also found 0 vulnerabilities in packages you import and 1
@@ -42,14 +42,14 @@ Vulnerability #1: GO-2021-0113
4242
Fixed in: golang.org/x/text@v0.3.7
4343
Example traces found:
4444
#1: for function golang.org/x/text/language.MustParse
45-
.../main.go:26:3: golang.org/multientry.main
46-
.../main.go:48:8: golang.org/multientry.D
47-
.../main.go:99:20: golang.org/multientry.foobar
48-
.../tags.go:13:6: golang.org/x/text/language.MustParse
45+
.../main.go:<l>:<c>: golang.org/multientry.main
46+
.../main.go:<l>:<c>: golang.org/multientry.D
47+
.../main.go:<l>:<c>: golang.org/multientry.foobar
48+
.../tags.go:<l>:<c>: golang.org/x/text/language.MustParse
4949
#2: for function golang.org/x/text/language.Parse
50-
.../main.go:22:3: golang.org/multientry.main
51-
.../main.go:44:23: golang.org/multientry.C
52-
.../parse.go:33:6: golang.org/x/text/language.Parse
50+
.../main.go:<l>:<c>: golang.org/multientry.main
51+
.../main.go:<l>:<c>: golang.org/multientry.C
52+
.../parse.go:<l>:<c>: golang.org/x/text/language.Parse
5353

5454
=== Package Results ===
5555

‎cmd/govulncheck/testdata/testfiles/source-call/source_replace_text.ct

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ Vulnerability #1: GO-2021-0113
1616
Found in: golang.org/x/text@v0.3.0
1717
Fixed in: golang.org/x/text@v0.3.7
1818
Example traces found:
19-
#1: .../main.go:11:16: replace.main calls language.Parse
19+
#1: .../main.go:<l>:<c>: replace.main calls language.Parse
2020

2121
Your code is affected by 1 vulnerability from 1 module.
2222
This scan also found 0 vulnerabilities in packages you import and 2

0 commit comments

Comments
 (0)