Skip to content

Commit 9c23f01

Browse files
zpavlinoviczpavlinovic
committed
internal/scan: limit number of binary traces shown
Traces, e.g., symbols in binary mode are not as useful as they are in the source mode. Users cannot directly act on the binary using this info. Given potential future reports for vulnerabilities in the main module of binaries, which won't have symbol info, and current precision levels for stripped binaries, there can be many traces shown. This can spam the user without providing really useful information. We hence limit the number of traces shown and provide annotation instructing users on how to retrieve the remaining traces. Change-Id: Ib58b6d29df8a7b9cce5e16173db036f0183f2b85 Reviewed-on: https://go-review.googlesource.com/c/vuln/+/587996 Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Maceo Thompson <maceothompson@google.com>
1 parent c6f8485 commit 9c23f01

File tree

4 files changed

+88
-14
lines changed

4 files changed

+88
-14
lines changed

‎cmd/govulncheck/testdata/strip/testfiles/binary/strip.ct

Lines changed: 64 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,12 @@ Vulnerability #1: GO-2021-0113
1313
Found in: golang.org/x/text@v0.3.0
1414
Fixed in: golang.org/x/text@v0.3.7
1515
Vulnerable symbols found:
16-
#1: language.MatchStrings
17-
#2: language.MustParse
18-
#3: language.Parse
19-
#4: language.ParseAcceptLanguage
16+
#1: language.Compose
17+
#2: language.Make
18+
#3: language.MatchStrings
19+
#4: language.MustParse
20+
#5: language.Parse
21+
Use '-show traces' to see the other 7 found symbols
2022

2123
Vulnerability #2: GO-2020-0015
2224
Infinite loop when decoding some inputs in golang.org/x/text
@@ -33,3 +35,61 @@ Your code is affected by 2 vulnerabilities from 1 module.
3335
This scan found no other vulnerabilities in packages you import or modules you
3436
require.
3537
Use '-show verbose' for more details.
38+
39+
# The same as above but with '-show traces'.
40+
$ govulncheck -mode=binary -show traces ${strip_vuln_binary} --> FAIL 3
41+
=== Symbol Results ===
42+
43+
Vulnerability #1: GO-2021-0113
44+
Due to improper index calculation, an incorrectly formatted language tag can
45+
cause Parse to panic via an out of bounds read. If Parse is used to process
46+
untrusted user inputs, this may be used as a vector for a denial of service
47+
attack.
48+
More info: https://pkg.go.dev/vuln/GO-2021-0113
49+
Module: golang.org/x/text
50+
Found in: golang.org/x/text@v0.3.0
51+
Fixed in: golang.org/x/text@v0.3.7
52+
Vulnerable symbols found:
53+
#1: for function golang.org/x/text/language.Compose
54+
golang.org/x/text/language.Compose
55+
#2: for function golang.org/x/text/language.Make
56+
golang.org/x/text/language.Make
57+
#3: for function golang.org/x/text/language.MatchStrings
58+
golang.org/x/text/language.MatchStrings
59+
#4: for function golang.org/x/text/language.MustParse
60+
golang.org/x/text/language.MustParse
61+
#5: for function golang.org/x/text/language.Parse
62+
golang.org/x/text/language.Parse
63+
#6: for function golang.org/x/text/language.ParseAcceptLanguage
64+
golang.org/x/text/language.ParseAcceptLanguage
65+
#7: for function golang.org/x/text/language.Tag.Base
66+
golang.org/x/text/language.Tag.Base
67+
#8: for function golang.org/x/text/language.Tag.Extension
68+
golang.org/x/text/language.Tag.Extension
69+
#9: for function golang.org/x/text/language.Tag.IsRoot
70+
golang.org/x/text/language.Tag.IsRoot
71+
#10: for function golang.org/x/text/language.Tag.Parent
72+
golang.org/x/text/language.Tag.Parent
73+
#11: for function golang.org/x/text/language.Tag.Region
74+
golang.org/x/text/language.Tag.Region
75+
#12: for function golang.org/x/text/language.Tag.String
76+
golang.org/x/text/language.Tag.String
77+
78+
Vulnerability #2: GO-2020-0015
79+
Infinite loop when decoding some inputs in golang.org/x/text
80+
More info: https://pkg.go.dev/vuln/GO-2020-0015
81+
Module: golang.org/x/text
82+
Found in: golang.org/x/text@v0.3.0
83+
Fixed in: golang.org/x/text@v0.3.3
84+
Vulnerable symbols found:
85+
#1: for function golang.org/x/text/transform.String
86+
golang.org/x/text/transform.String
87+
#2: for function golang.org/x/text/encoding/unicode.bomOverride.Transform
88+
golang.org/x/text/encoding/unicode.bomOverride.Transform
89+
#3: for function golang.org/x/text/encoding/unicode.utf16Decoder.Transform
90+
golang.org/x/text/encoding/unicode.utf16Decoder.Transform
91+
92+
Your code is affected by 2 vulnerabilities from 1 module.
93+
This scan found no other vulnerabilities in packages you import or modules you
94+
require.
95+
Use '-show verbose' for more details.

‎cmd/govulncheck/testdata/strip/vulndb-v1/ID/GO-2021-0113.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"schema_version":"1.3.1","id":"GO-2021-0113","modified":"2023-04-03T15:57:51Z","published":"2021-10-06T17:51:21Z","aliases":["CVE-2021-38561","GHSA-ppp9-7jff-5vj2"],"details":"Due to improper index calculation, an incorrectly formatted language tag can cause Parse to panic via an out of bounds read. If Parse is used to process untrusted user inputs, this may be used as a vector for a denial of service attack.","affected":[{"package":{"name":"golang.org/x/text","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.7"}]}],"ecosystem_specific":{"imports":[{"path":"golang.org/x/text/language","symbols":["MatchStrings","MustParse","Parse","ParseAcceptLanguage"]}]}}],"references":[{"type":"FIX","url":"https://go.dev/cl/340830"},{"type":"FIX","url":"https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f"}],"credits":[{"name":"Guido Vranken"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2021-0113"}}
1+
{"schema_version":"1.3.1","id":"GO-2021-0113","modified":"2023-04-03T15:57:51Z","published":"2021-10-06T17:51:21Z","aliases":["CVE-2021-38561","GHSA-ppp9-7jff-5vj2"],"details":"Due to improper index calculation, an incorrectly formatted language tag can cause Parse to panic via an out of bounds read. If Parse is used to process untrusted user inputs, this may be used as a vector for a denial of service attack.","affected":[{"package":{"name":"golang.org/x/text","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.7"}]}],"ecosystem_specific":{"imports":[{"path":"golang.org/x/text/language","symbols":["MatchStrings","MustParse","Parse","ParseAcceptLanguage","Compose","Make","Tag.Base","Tag.Extension","Tag.IsRoot","Tag.Parent","Tag.Region","Tag.String"]}]}}],"references":[{"type":"FIX","url":"https://go.dev/cl/340830"},{"type":"FIX","url":"https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f"}],"credits":[{"name":"Guido Vranken"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2021-0113"}}

‎cmd/govulncheck/testdata/strip/vulndb-v1/ID/GO-2021-0113.json.gz

53 Bytes
Binary file not shown.

‎internal/scan/text.go

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -297,23 +297,37 @@ func (h *TextHandler) traces(traces []*findingSummary) {
297297
return symbol(traces[i].Trace[0], true) < symbol(traces[j].Trace[0], true)
298298
})
299299

300-
first := true
301-
count := 1
302-
for _, entry := range traces {
303-
if entry.Compact == "" {
304-
continue // skip package and module level traces
300+
// compacts are finding summaries with compact traces
301+
// suitable for non-verbose textual output. Currently,
302+
// only traces produced by symbol analysis.
303+
var compacts []*findingSummary
304+
for _, t := range traces {
305+
if t.Compact != "" {
306+
compacts = append(compacts, t)
305307
}
306-
if first {
308+
}
309+
310+
// binLimit is a limit on the number of binary traces
311+
// to show. Traces for binaries are less interesting
312+
// as users cannot act on them and they can hence
313+
// spam users.
314+
const binLimit = 5
315+
for i, entry := range compacts {
316+
if i == 0 {
307317
if h.scanMode == govulncheck.ScanModeBinary {
308318
h.style(keyStyle, " Vulnerable symbols found:\n")
309319
} else {
310320
h.style(keyStyle, " Example traces found:\n")
311321
}
312322
}
313-
first = false
314323

315-
h.print(" #", count, ": ")
316-
count++
324+
// skip showing all symbols in binary mode unless '-show traces' is on.
325+
if h.scanMode == govulncheck.ScanModeBinary && (i+1) > binLimit && !h.showTraces {
326+
h.print(" Use '-show traces' to see the other ", len(compacts)-binLimit, " found symbols\n")
327+
break
328+
}
329+
330+
h.print(" #", i+1, ": ")
317331
if !h.showTraces {
318332
h.print(entry.Compact, "\n")
319333
} else {

0 commit comments

Comments
 (0)