internal/report: add a lint check for module existence

Add a basic lint check that the proxy knows about each module
listed in a report. This allows us to do basic checking on
low-information reports where we don't know versions, packages or symbols.

Change-Id: I92d06cbd27d89ead7725d131e69087085c4cdba5
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/576996
Reviewed-by: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

Author: tatianab

internal/report/lint.go

@@ -25,6 +25,10 @@ import (
 )
 
 func (m *Module) checkModVersions(pc *proxy.Client) error {
+	if ok := pc.ModuleExists(m.Module); !ok {
+		return fmt.Errorf("module %s not known to proxy", m.Module)
+	}
+
 	var notFound []string
 	var nonCanonical []string
 	for _, vr := range m.Versions {
@@ -272,8 +276,8 @@ func (r *Report) countAdvisories() int {
 }
 
 func (r *Report) missingAdvisory(advisoryCount int) bool {
-	return !r.IsExcluded() && !r.IsFirstParty() &&
-		advisoryCount == 0 && r.Description == "" && r.CVEMetadata == nil
+	return !r.IsExcluded() && r.Description == "" && !r.IsFirstParty() &&
+		advisoryCount == 0 && r.CVEMetadata == nil
 }
 
 func (d *Description) lint(l *linter, r *Report) {
@@ -309,13 +313,8 @@ func (s *Summary) lint(l *linter, r *Report) {
 	if strings.HasSuffix(summary, ".") {
 		l.Error("must not end in a period (should be a phrase, not a sentence)")
 	}
-	for i, r := range summary {
-		if i != 0 {
-			break
-		}
-		if !unicode.IsUpper(r) {
-			l.Error("must begin with a capital letter")
-		}
+	if !startsWithUpper(summary) {
+		l.Error("must begin with a capital letter")
 	}
 
 	// Summary must contain one of the listed module or package
@@ -330,6 +329,18 @@ func (s *Summary) lint(l *linter, r *Report) {
 	}
 }
 
+func startsWithUpper(s string) bool {
+	for i, r := range s {
+		if i != 0 {
+			return true
+		}
+		if !unicode.IsUpper(r) {
+			return false
+		}
+	}
+	return false
+}
+
 // containsPath returns whether the summary contains one of
 // the paths in paths.
 // As a special case, if the summary contains a word that contains a "/"
@@ -482,7 +493,7 @@ func (m *Module) lint(l *linter, r *Report, pc *proxy.Client) {
 		l.Error("no module name")
 	}
 
-	if !m.IsFirstParty() && pc != nil {
+	if !r.IsExcluded() && !m.IsFirstParty() && pc != nil {
 		if err := m.checkModVersions(pc); err != nil {
 			l.Error(err)
 		}

internal/report/testdata/proxy/TestGHSAToReport.json

@@ -1,13 +1,13 @@
 {
 	"golang.org/x/tools/@v/list": {
-		"body": "v0.1.4\nv0.9.3\nv0.7.0\nv0.1.12\nv0.1.3\nv0.9.2\nv0.3.0\nv0.8.0\nv0.6.0\nv0.10.0\nv0.1.9\nv0.5.0\nv0.1.7\nv0.1.10\nv0.12.0\nv0.1.6\nv0.1.2\nv0.9.0\nv0.1.11\nv0.4.0\nv0.1.8\nv0.11.0\nv0.1.0\nv0.1.5\nv0.9.1\nv0.1.1\nv0.11.1\nv0.2.0\n",
+		"body": "v0.15.0\nv0.1.4\nv0.9.3\nv0.7.0\nv0.1.12\nv0.1.3\nv0.9.2\nv0.3.0\nv0.8.0\nv0.6.0\nv0.10.0\nv0.20.0\nv0.1.9\nv0.5.0\nv0.18.0\nv0.1.7\nv0.1.10\nv0.12.0\nv0.1.6\nv0.19.0\nv0.1.2\nv0.9.0\nv0.1.11\nv0.4.0\nv0.1.8\nv0.14.0\nv0.11.0\nv0.1.0\nv0.1.5\nv0.9.1\nv0.1.1\nv0.11.1\nv0.16.1\nv0.13.0\nv0.17.0\nv0.2.0\nv0.16.0\n",
 		"status_code": 200
 	},
 	"golang.org/x/tools/@v/v0.9.0.mod": {
 		"body": "module golang.org/x/tools\n\ngo 1.18 // tagx:compat 1.16\n\nrequire (\n\tgithub.com/yuin/goldmark v1.4.13\n\tgolang.org/x/mod v0.10.0\n\tgolang.org/x/net v0.10.0\n\tgolang.org/x/sys v0.8.0\n)\n\nrequire golang.org/x/sync v0.2.0\n",
 		"status_code": 200
 	},
-	"golang.org/x/tools/go/packages/@v/v0.9.0.mod": {
+	"golang.org/x/tools/go/packages/@v/list": {
 		"status_code": 404
 	}
 }

internal/report/testdata/proxy/TestLint.json

@@ -1,4 +1,8 @@
 {
+	"github.com/golang/vuln/@v/list": {
+		"body": "v1.0.2\nv1.0.0\nv1.0.3\nv1.0.4\nv0.1.0\nv1.0.1\nv0.2.0\n",
+		"status_code": 200
+	},
 	"github.com/golang/vuln/@v/v0.1.0.mod": {
 		"body": "module golang.org/x/vuln\n\ngo 1.18\n\nrequire (\n\tgithub.com/client9/misspell v0.3.4\n\tgithub.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786\n\tgithub.com/google/go-cmp v0.5.8\n\tgolang.org/x/mod v0.10.0\n\tgolang.org/x/sync v0.1.0\n\tgolang.org/x/tools v0.8.1-0.20230421161920-b9619ee54b47\n\thonnef.co/go/tools v0.4.3\n\tmvdan.cc/unparam v0.0.0-20230312165513-e84e2d14e3b8\n)\n\nrequire (\n\tgithub.com/BurntSushi/toml v1.2.1 // indirect\n\tgithub.com/google/renameio v0.1.0 // indirect\n\tgolang.org/x/exp/typeparams v0.0.0-20221208152030-732eee02a75a // indirect\n\tgolang.org/x/sys v0.7.0 // indirect\n)\n",
 		"status_code": 200
@@ -9,6 +13,10 @@
 	"github.com/golang/vuln/@v/v0.2.6.mod": {
 		"status_code": 404
 	},
+	"golang.org/x/net/@v/list": {
+		"body": "v0.15.0\nv0.7.0\nv0.3.0\nv0.8.0\nv0.6.0\nv0.10.0\nv0.20.0\nv0.24.0\nv0.23.0\nv0.5.0\nv0.22.0\nv0.18.0\nv0.21.0\nv0.12.0\nv0.19.0\nv0.9.0\nv0.4.0\nv0.14.0\nv0.11.0\nv0.1.0\nv0.13.0\nv0.17.0\nv0.2.0\nv0.16.0\n",
+		"status_code": 200
+	},
 	"golang.org/x/net/@v/v0.2.0.mod": {
 		"body": "module golang.org/x/net\n\ngo 1.17\n\nrequire (\n\tgolang.org/x/sys v0.2.0\n\tgolang.org/x/term v0.2.0\n\tgolang.org/x/text v0.4.0\n)\n",
 		"status_code": 200