Skip to content

Commit e313109

Browse files
dmitshurgopherbot
dmitshur
authored and
gopherbot
committed
cmd/govulncheck: update test data
Generated with 'go test -update' for changes introduced by CL 555515. For golang/go#65084. Change-Id: I05938ce2755b6acdd42efc3fe9f51a485d8ca405 Cq-Include-Trybots: luci.golang.try:x_vuln-gotip-linux-amd64-longtest Reviewed-on: https://go-review.googlesource.com/c/vuln/+/555655 Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
1 parent d8d123b commit e313109

File tree

2 files changed

+111
-30
lines changed

2 files changed

+111
-30
lines changed

‎cmd/govulncheck/testdata/testfiles/source-call/source_vuln_json.ct

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -468,6 +468,81 @@ $ govulncheck -C ${moddir}/vuln -json ./...
468468
]
469469
}
470470
}
471+
{
472+
"finding": {
473+
"osv": "GO-2021-0054",
474+
"fixed_version": "v1.6.6",
475+
"trace": [
476+
{
477+
"module": "github.com/tidwall/gjson",
478+
"version": "v1.6.5",
479+
"package": "github.com/tidwall/gjson",
480+
"function": "ForEach",
481+
"receiver": "Result"
482+
},
483+
{
484+
"module": "github.com/tidwall/gjson",
485+
"version": "v1.6.5",
486+
"package": "github.com/tidwall/gjson",
487+
"function": "modPretty",
488+
"position": {
489+
"filename": ".../gjson.go",
490+
"offset": 53718,
491+
"line": 2631,
492+
"column": 21
493+
}
494+
},
495+
{
496+
"module": "github.com/tidwall/gjson",
497+
"version": "v1.6.5",
498+
"package": "github.com/tidwall/gjson",
499+
"function": "execModifier",
500+
"position": {
501+
"filename": ".../gjson.go",
502+
"offset": 52543,
503+
"line": 2587,
504+
"column": 21
505+
}
506+
},
507+
{
508+
"module": "github.com/tidwall/gjson",
509+
"version": "v1.6.5",
510+
"package": "github.com/tidwall/gjson",
511+
"function": "Get",
512+
"position": {
513+
"filename": ".../gjson.go",
514+
"offset": 38077,
515+
"line": 1881,
516+
"column": 36
517+
}
518+
},
519+
{
520+
"module": "github.com/tidwall/gjson",
521+
"version": "v1.6.5",
522+
"package": "github.com/tidwall/gjson",
523+
"function": "Get",
524+
"receiver": "Result",
525+
"position": {
526+
"filename": ".../gjson.go",
527+
"offset": 5781,
528+
"line": 297,
529+
"column": 12
530+
}
531+
},
532+
{
533+
"module": "golang.org/vuln",
534+
"package": "golang.org/vuln",
535+
"function": "main",
536+
"position": {
537+
"filename": ".../vuln.go",
538+
"offset": 183,
539+
"line": 14,
540+
"column": 20
541+
}
542+
}
543+
]
544+
}
545+
}
471546
{
472547
"osv": {
473548
"schema_version": "1.3.1",

‎cmd/govulncheck/testdata/testfiles/source-call/source_vuln_text.ct

Lines changed: 36 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,21 @@ Vulnerability #2: GO-2021-0113
2525
Example traces found:
2626
#1: .../vuln.go:13:16: vuln.main calls language.Parse
2727

28+
Vulnerability #3: GO-2021-0054
29+
Due to improper bounds checking, maliciously crafted JSON objects can cause
30+
an out-of-bounds panic. If parsing user input, this may be used as a denial
31+
of service vector.
32+
More info: https://pkg.go.dev/vuln/GO-2021-0054
33+
Module: github.com/tidwall/gjson
34+
Found in: github.com/tidwall/gjson@v1.6.5
35+
Fixed in: github.com/tidwall/gjson@v1.6.6
36+
Example traces found:
37+
#1: .../vuln.go:14:20: vuln.main calls gjson.Result.Get, which eventually calls gjson.Result.ForEach
38+
2839
=== Informational ===
2940

30-
Found 1 vulnerability in packages that you import, but there are no
31-
call stacks leading to the use of this vulnerability. There are also 2
32-
vulnerabilities in modules that you require that are neither imported
33-
nor called. You may not need to take any action.
41+
There are 2 vulnerabilities in modules that you require that are
42+
neither imported nor called. You may not need to take any action.
3443
See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck for details.
3544

3645
Vulnerability #1: GO-2022-0969
@@ -42,16 +51,7 @@ Vulnerability #1: GO-2022-0969
4251
Found in: net/http@go1.18
4352
Fixed in: net/http@go1.18.6
4453

45-
Vulnerability #2: GO-2021-0054
46-
Due to improper bounds checking, maliciously crafted JSON objects can cause
47-
an out-of-bounds panic. If parsing user input, this may be used as a denial
48-
of service vector.
49-
More info: https://pkg.go.dev/vuln/GO-2021-0054
50-
Module: github.com/tidwall/gjson
51-
Found in: github.com/tidwall/gjson@v1.6.5
52-
Fixed in: github.com/tidwall/gjson@v1.6.6
53-
54-
Vulnerability #3: GO-2020-0015
54+
Vulnerability #2: GO-2020-0015
5555
An attacker could provide a single byte to a UTF16 decoder instantiated with
5656
UseBOM or ExpectBOM to trigger an infinite loop if the String function on
5757
the Decoder is called, or the Decoder is passed to transform.String. If used
@@ -62,7 +62,7 @@ Vulnerability #3: GO-2020-0015
6262
Found in: golang.org/x/text@v0.3.0
6363
Fixed in: golang.org/x/text@v0.3.3
6464

65-
Your code is affected by 2 vulnerabilities from 2 modules.
65+
Your code is affected by 3 vulnerabilities from 2 modules.
6666

6767
Share feedback at https://go.dev/s/govulncheck-feedback.
6868

@@ -97,12 +97,27 @@ Vulnerability #2: GO-2021-0113
9797
.../vuln.go:13:16: golang.org/vuln.main
9898
golang.org/x/text/language.Parse
9999

100+
Vulnerability #3: GO-2021-0054
101+
Due to improper bounds checking, maliciously crafted JSON objects can cause
102+
an out-of-bounds panic. If parsing user input, this may be used as a denial
103+
of service vector.
104+
More info: https://pkg.go.dev/vuln/GO-2021-0054
105+
Module: github.com/tidwall/gjson
106+
Found in: github.com/tidwall/gjson@v1.6.5
107+
Fixed in: github.com/tidwall/gjson@v1.6.6
108+
Example traces found:
109+
#1: for function github.com/tidwall/gjson.Result.ForEach
110+
.../vuln.go:14:20: golang.org/vuln.main
111+
.../gjson.go:297:12: github.com/tidwall/gjson.Result.Get
112+
.../gjson.go:1881:36: github.com/tidwall/gjson.Get
113+
.../gjson.go:2587:21: github.com/tidwall/gjson.execModifier
114+
.../gjson.go:2631:21: github.com/tidwall/gjson.modPretty
115+
github.com/tidwall/gjson.Result.ForEach
116+
100117
=== Informational ===
101118

102-
Found 1 vulnerability in packages that you import, but there are no
103-
call stacks leading to the use of this vulnerability. There are also 2
104-
vulnerabilities in modules that you require that are neither imported
105-
nor called. You may not need to take any action.
119+
There are 2 vulnerabilities in modules that you require that are
120+
neither imported nor called. You may not need to take any action.
106121
See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck for details.
107122

108123
Vulnerability #1: GO-2022-0969
@@ -114,16 +129,7 @@ Vulnerability #1: GO-2022-0969
114129
Found in: net/http@go1.18
115130
Fixed in: net/http@go1.18.6
116131

117-
Vulnerability #2: GO-2021-0054
118-
Due to improper bounds checking, maliciously crafted JSON objects can cause
119-
an out-of-bounds panic. If parsing user input, this may be used as a denial
120-
of service vector.
121-
More info: https://pkg.go.dev/vuln/GO-2021-0054
122-
Module: github.com/tidwall/gjson
123-
Found in: github.com/tidwall/gjson@v1.6.5
124-
Fixed in: github.com/tidwall/gjson@v1.6.6
125-
126-
Vulnerability #3: GO-2020-0015
132+
Vulnerability #2: GO-2020-0015
127133
An attacker could provide a single byte to a UTF16 decoder instantiated with
128134
UseBOM or ExpectBOM to trigger an infinite loop if the String function on
129135
the Decoder is called, or the Decoder is passed to transform.String. If used
@@ -134,6 +140,6 @@ Vulnerability #3: GO-2020-0015
134140
Found in: golang.org/x/text@v0.3.0
135141
Fixed in: golang.org/x/text@v0.3.3
136142

137-
Your code is affected by 2 vulnerabilities from 2 modules.
143+
Your code is affected by 3 vulnerabilities from 2 modules.
138144

139145
Share feedback at https://go.dev/s/govulncheck-feedback.

0 commit comments

Comments
 (0)