Skip to content

Commit a3a17c9

Browse files
rolandshoemakerrolandshoemaker
committed
all: switch from toml to yaml
Change-Id: I9fb36a246d0d532e44a28903998b9750cf794a85 Reviewed-on: https://team-review.git.corp.google.com/c/golang/vulndb/+/1055925 Reviewed-by: Roland Shoemaker <bracewell@google.com>
1 parent 29b7148 commit a3a17c9

File tree

197 files changed

+1759
-2331
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

197 files changed

+1759
-2331
lines changed

‎cmd/gendb/main.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ import (
1414
"reflect"
1515
"strings"
1616

17-
"github.com/BurntSushi/toml"
1817
"golang.org/x/vulndb/osv"
1918
"golang.org/x/vulndb/report"
19+
"gopkg.in/yaml.v2"
2020
)
2121

2222
func fail(why string) {
@@ -52,15 +52,15 @@ func main() {
5252

5353
jsonVulns := map[string][]osv.Entry{}
5454
for _, f := range tomlFiles {
55-
if !strings.HasSuffix(f.Name(), ".toml") {
55+
if !strings.HasSuffix(f.Name(), ".yaml") {
5656
continue
5757
}
5858
content, err := ioutil.ReadFile(filepath.Join(*tomlDir, f.Name()))
5959
if err != nil {
6060
fail(fmt.Sprintf("can't read %q: %s", f.Name(), err))
6161
}
6262
var vuln report.Report
63-
err = toml.Unmarshal(content, &vuln)
63+
err = yaml.Unmarshal(content, &vuln)
6464
if err != nil {
6565
fail(fmt.Sprintf("unable to unmarshal %q: %s", f.Name(), err))
6666
}

‎cmd/genhtml/main.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ import (
1414
"sort"
1515
"strings"
1616

17-
"github.com/BurntSushi/toml"
1817
"golang.org/x/vulndb/report"
18+
"gopkg.in/yaml.v2"
1919
)
2020

2121
var indexTemplate = template.Must(template.New("index").Parse(`<html>
@@ -194,7 +194,7 @@ func main() {
194194
fail(fmt.Sprintf("can't read %q: %s", f.Name(), err))
195195
}
196196
var vuln report.Report
197-
err = toml.Unmarshal(content, &vuln)
197+
err = yaml.Unmarshal(content, &vuln)
198198
if err != nil {
199199
fail(fmt.Sprintf("unable to unmarshal %q: %s", f.Name(), err))
200200
}

‎cmd/linter/main.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@ import (
1010
"os"
1111

1212
"golang.org/x/vulndb/report"
13-
14-
"github.com/BurntSushi/toml"
13+
"gopkg.in/yaml.v2"
1514
)
1615

1716
func main() {
@@ -27,7 +26,7 @@ func main() {
2726
}
2827

2928
var vuln report.Report
30-
err = toml.Unmarshal(content, &vuln)
29+
err = yaml.Unmarshal(content, &vuln)
3130
if err != nil {
3231
fmt.Fprintf(os.Stderr, "unable to parse %q: %s\n", os.Args[1], err)
3332
os.Exit(1)

‎cmd/report2cve/main.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ import (
1111
"os"
1212
"strings"
1313

14-
"github.com/BurntSushi/toml"
1514
"golang.org/x/vulndb/report"
15+
"gopkg.in/yaml.v2"
1616
)
1717

1818
// Affects
@@ -224,7 +224,7 @@ func main() {
224224
}
225225

226226
var r report.Report
227-
if err = toml.Unmarshal(b, &r); err != nil {
227+
if err = yaml.Unmarshal(b, &r); err != nil {
228228
fmt.Fprintf(os.Stderr, "failed to parse %q: %s\n", reportPath, err)
229229
os.Exit(1)
230230
}

‎go.mod

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,5 @@ require (
66
github.com/BurntSushi/toml v0.3.1
77
github.com/google/go-cmp v0.5.4
88
golang.org/x/mod v0.4.1
9+
gopkg.in/yaml.v2 v2.4.0
910
)

‎go.sum

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,7 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
1717
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
1818
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
1919
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
20+
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
21+
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
22+
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
23+
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=

‎report/report.go

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -7,49 +7,49 @@ package report
77
import "time"
88

99
type VersionRange struct {
10-
Introduced string
11-
Fixed string
10+
Introduced string `yaml:",omitempty"`
11+
Fixed string `yaml:",omitempty"`
1212
}
1313

1414
type Report struct {
15-
Module string
16-
Package string
15+
Module string `yaml:",omitempty"`
16+
Package string `yaml:",omitempty"`
1717
// TODO: could also be GoToolchain, but we might want
1818
// this for other things?
1919
//
2020
// could we also automate this by just looking for
2121
// things prefixed with cmd/go?
22-
DoNotExport bool `json:"do_not_export"`
22+
DoNotExport bool `yaml:"do_not_export,omitempty"`
2323
// TODO: how does this interact with Versions etc?
24-
Stdlib bool `json:"stdlib"`
24+
Stdlib bool `yaml:",omitempty"`
2525
// TODO: the most common usage of additional package should
2626
// really be replaced with 'aliases', we'll still need
2727
// additional packages for some cases, but it's too heavy
2828
// for most
2929
AdditionalPackages []struct {
30-
Module string
31-
Package string
32-
Symbols []string
33-
Versions []VersionRange
34-
} `toml:"additional_packages"`
35-
Versions []VersionRange
36-
Description string
37-
Published time.Time
38-
LastModified *time.Time `toml:"last_modified"`
39-
Withdrawn *time.Time
40-
CVE string
41-
Credit string
42-
Symbols []string
43-
OS []string
44-
Arch []string
30+
Module string `yaml:",omitempty"`
31+
Package string `yaml:",omitempty"`
32+
Symbols []string `yaml:",omitempty"`
33+
Versions []VersionRange `yaml:",omitempty"`
34+
} `yaml:"additional_packages,omitempty"`
35+
Versions []VersionRange `yaml:",omitempty"`
36+
Description string `yaml:",omitempty"`
37+
Published time.Time `yaml:",omitempty"`
38+
LastModified *time.Time `yaml:"last_modified,omitempty"`
39+
Withdrawn *time.Time `yaml:",omitempty"`
40+
CVE string `yaml:",omitempty"`
41+
Credit string `yaml:",omitempty"`
42+
Symbols []string `yaml:",omitempty"`
43+
OS []string `yaml:",omitempty"`
44+
Arch []string `yaml:",omitempty"`
4545
Links struct {
46-
PR string
47-
Commit string
48-
Context []string
49-
}
46+
PR string `yaml:",omitempty"`
47+
Commit string `yaml:",omitempty"`
48+
Context []string `yaml:",omitempty"`
49+
} `yaml:",omitempty"`
5050
CVEMetadata *struct {
51-
ID string
52-
CWE string
53-
Description string
54-
} `toml:"cve_metadata"`
51+
ID string `yaml:",omitempty"`
52+
CWE string `yaml:",omitempty"`
53+
Description string `yaml:",omitempty"`
54+
} `yaml:"cve_metadata,omitempty"`
5555
}

‎reports/GO-2020-0001.toml

Lines changed: 0 additions & 31 deletions
This file was deleted.

‎reports/GO-2020-0001.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
module: github.com/gin-gonic/gin
2+
versions:
3+
- fixed: v1.6.0
4+
description: |
5+
The default [`Formatter`][LoggerConfig.Formatter] for the [`Logger`][] middleware
6+
(included in the [`Default`][] engine) allows attackers to inject arbitrary log
7+
entries by manipulating the request path.
8+
published: 2021-04-14T12:00:00Z
9+
credit: '@thinkerou <thinkerou@gmail.com>'
10+
symbols:
11+
- defaultLogFormatter
12+
links:
13+
pr: https://github.com/gin-gonic/gin/pull/2237
14+
commit: https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d
15+
cve_metadata:
16+
id: CVE-9999-0001
17+
cwe: 'CWE-20: Improper Input Validation'
18+
description: |
19+
Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0
20+
allows remote attackers to inject arbitary log lines.

‎reports/GO-2020-0002.toml

Lines changed: 0 additions & 20 deletions
This file was deleted.

0 commit comments

Comments
 (0)