pax_global_header 0000666 0000000 0000000 00000000064 14560503771 0014522 g ustar 00root root 0000000 0000000 52 comment=5507063454b1b8c930db99818a88b52f1f143418
vuln-1.0.4/ 0000775 0000000 0000000 00000000000 14560503771 0012510 5 ustar 00root root 0000000 0000000 vuln-1.0.4/.gitignore 0000664 0000000 0000000 00000000077 14560503771 0014504 0 ustar 00root root 0000000 0000000 **/.terraform/*
.terraform.lock.hcl
terraform/terraform.tfvars
vuln-1.0.4/CONTRIBUTING.md 0000664 0000000 0000000 00000001743 14560503771 0014746 0 ustar 00root root 0000000 0000000 # Contributing to the Go Vulnerability Database
Go is an open source project.
It is the work of hundreds of contributors. We appreciate your help!
## Reporting a vulnerability
To report a new *public* vulnerability,
[open an issue](https://github.com/golang/vulndb/issues/new),
send a GitHub PR, or mail a Gerrit CL.
Please read the
[Contribution Guidelines](https://golang.org/doc/contribute.html)
before sending patches.
## Contributor License Agreement
Contributions to this project must be accompanied by a Contributor License
Agreement (CLA). You (or your employer) retain the copyright to your
contribution; this simply gives us permission to use and redistribute your
contributions as part of the project. Head over to
to see your current agreements on file or
to sign a new one.
You generally only need to submit a CLA once, so if you've already submitted one
(even if it was for a different project), you probably don't need to do it
again.
vuln-1.0.4/LICENSE 0000664 0000000 0000000 00000002707 14560503771 0013523 0 ustar 00root root 0000000 0000000 Copyright (c) 2009 The Go Authors. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
* Neither the name of Google Inc. nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
vuln-1.0.4/PATENTS 0000664 0000000 0000000 00000002427 14560503771 0013556 0 ustar 00root root 0000000 0000000 Additional IP Rights Grant (Patents)
"This implementation" means the copyrightable works distributed by
Google as part of the Go project.
Google hereby grants to You a perpetual, worldwide, non-exclusive,
no-charge, royalty-free, irrevocable (except as stated in this section)
patent license to make, have made, use, offer to sell, sell, import,
transfer and otherwise run, modify and propagate the contents of this
implementation of Go, where such license applies only to those patent
claims, both currently owned or controlled by Google and acquired in
the future, licensable by Google that are necessarily infringed by this
implementation of Go. This grant does not include claims that would be
infringed only as a consequence of further modification of this
implementation. If you or your agent or exclusive licensee institute or
order or agree to the institution of patent litigation against any
entity (including a cross-claim or counterclaim in a lawsuit) alleging
that this implementation of Go or any code incorporated within this
implementation of Go constitutes direct or contributory patent
infringement, or inducement of patent infringement, then any patent
rights granted to you under this License for this implementation of Go
shall terminate as of the date such litigation is filed.
vuln-1.0.4/README.md 0000664 0000000 0000000 00000003033 14560503771 0013766 0 ustar 00root root 0000000 0000000 # Go Vulnerability Management
[](https://pkg.go.dev/golang.org/x/vuln)
Go's support for vulnerability management includes tooling for analyzing your
codebase and binaries to surface known vulnerabilities in your dependencies.
This tooling is backed by the Go vulnerability database, which is curated by
the Go security team. Go’s tooling reduces noise in your results by only
surfacing vulnerabilities in functions that your code is actually calling.
You can install the latest version of govulncheck using
[go install](https://pkg.go.dev/cmd/go#hdr-Compile_and_install_packages_and_dependencies)
```
go install golang.org/x/vuln/cmd/govulncheck@latest
```
Then, run govulncheck inside your module:
```
govulncheck ./...
```
See [the govulncheck tutorial](https://go.dev/doc/tutorial/govulncheck) to get
started, and [https://go.dev/security/vuln](https://go.dev/security/vuln) for
more information about Go's support for vulnerability management. The API
documentation can be found at
[https://pkg.go.dev/golang.org/x/vuln/scan](https://pkg.go.dev/golang.org/x/vuln/scan).
## Privacy Policy
The privacy policy for `govulncheck` can be found at
[https://vuln.go.dev/privacy](https://vuln.go.dev/privacy).
## License
Unless otherwise noted, the Go source files are distributed under the BSD-style
license found in the LICENSE file.
Database entries available at https://vuln.go.dev are distributed under the
terms of the [CC-BY 4.0](https://creativecommons.org/licenses/by/4.0/) license.
vuln-1.0.4/all_test.go 0000664 0000000 0000000 00000007271 14560503771 0014655 0 ustar 00root root 0000000 0000000 // Copyright 2021 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
//go:build go1.17 && !windows
// +build go1.17,!windows
package main
import (
"bufio"
"bytes"
"context"
"io/fs"
"os"
"os/exec"
"regexp"
"strings"
"testing"
"golang.org/x/mod/modfile"
"golang.org/x/vuln/internal/testenv"
"golang.org/x/vuln/scan"
"mvdan.cc/unparam/check"
)
// excluded contains the set of modules that x/vuln should not depend on.
var excluded = map[string]bool{
"golang.org/x/exp": true,
}
var goHeader = regexp.MustCompile(`^// Copyright 20\d\d The Go Authors\. All rights reserved\.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file\.`)
func TestBashChecks(t *testing.T) {
skipIfShort(t)
bash, err := exec.LookPath("bash")
if err != nil {
t.Skipf("skipping: %v", err)
}
var cmd *exec.Cmd
if os.Getenv("GO_BUILDER_NAME") != "" {
cmd = exec.Command(bash, "./checks.bash", "trybots")
} else {
cmd = exec.Command(bash, "./checks.bash")
}
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
if err := cmd.Run(); err != nil {
t.Fatal(err)
}
}
func TestDependencies(t *testing.T) {
dat, err := os.ReadFile("go.mod")
if err != nil {
t.Fatal(err)
}
f, err := modfile.Parse("go.mod", dat, nil)
if err != nil {
t.Fatalf("modfile.Parse: %v", err)
}
for _, r := range f.Require {
// This is used by staticcheck.
if strings.HasPrefix(r.Mod.Path, "golang.org/x/exp/typeparams") {
continue
}
for ex := range excluded {
if strings.HasPrefix(r.Mod.Path, ex) {
t.Errorf("go.mod contains %q as a dependency, which should not happen", r.Mod.Path)
}
}
}
}
func TestGovulncheck(t *testing.T) {
skipIfShort(t)
testenv.NeedsGoBuild(t)
var o string
out := bytes.NewBufferString(o)
ctx := context.Background()
cmd := scan.Command(ctx, "./...")
cmd.Stdout = out
cmd.Stderr = out
err := cmd.Start()
if err == nil {
err = cmd.Wait()
}
t.Logf("govulncheck finished with std out/err:\n%s", out.String())
switch err := err.(type) {
case nil:
t.Log("govulncheck: no vulnerabilities detected")
case interface{ ExitCode() int }:
t.Errorf("govulncheck: unexpected exit code %d and error %v", err.ExitCode(), err)
default:
t.Errorf("govulncheck: abruptly failed with error %v", err)
}
}
func TestStaticCheck(t *testing.T) {
skipIfShort(t)
rungo(t, "run", "honnef.co/go/tools/cmd/staticcheck@v0.4.3", "./...")
}
func TestUnparam(t *testing.T) {
testenv.NeedsGoBuild(t)
warns, err := check.UnusedParams(false, false, false, "./...")
if err != nil {
t.Fatalf("check.UnusedParams: %v", err)
}
for _, warn := range warns {
t.Errorf(warn)
}
}
func TestVet(t *testing.T) {
rungo(t, "vet", "-all", "./...")
}
func TestMisspell(t *testing.T) {
skipIfShort(t)
rungo(t, "run", "github.com/client9/misspell/cmd/misspell@v0.3.4", "-error", ".")
}
func TestHeaders(t *testing.T) {
sfs := os.DirFS(".")
fs.WalkDir(sfs, ".", func(path string, d fs.DirEntry, _ error) error {
if d.IsDir() {
if d.Name() == "testdata" {
return fs.SkipDir
}
return nil
}
if !strings.HasSuffix(path, ".go") {
return nil
}
f, err := sfs.Open(path)
if err != nil {
return err
}
defer f.Close()
if !goHeader.MatchReader(bufio.NewReader(f)) {
t.Errorf("%v: incorrect go header", path)
}
return nil
})
}
func rungo(t *testing.T, args ...string) {
t.Helper()
testenv.NeedsGoBuild(t)
cmd := exec.Command("go", args...)
if output, err := cmd.CombinedOutput(); err != nil {
t.Log("\n" + string(output))
t.Error("command had non zero exit code")
}
}
func skipIfShort(t *testing.T) {
if testing.Short() {
t.Skipf("skipping: short mode")
}
}
vuln-1.0.4/checks.bash 0000775 0000000 0000000 00000003061 14560503771 0014612 0 ustar 00root root 0000000 0000000 #!/usr/bin/env bash
# Copyright 2021 The Go Authors. All rights reserved.
# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE file.
# This file will be run by `go test`.
# See all_test.go in this directory.
# Ensure that installed go binaries are on the path.
# This bash expression follows the algorithm described at the top of
# `go install help`: first try $GOBIN, then $GOPATH/bin, then $HOME/go/bin.
go_install_dir=${GOBIN:-${GOPATH:-$HOME/go}/bin}
PATH=$PATH:$go_install_dir
source devtools/lib.sh
# check_shellcheck runs shellcheck on .bash and .sh files.
check_shellcheck() {
if ! [ -x "$(command -v shellcheck)" ]; then
echo "Please install shellcheck. See https://github.com/koalaman/shellcheck#installing."
fi
runcmd shellcheck -x checks.bash
runcmd shellcheck ./**/*.sh
}
go_modtidy() {
runcmd go mod tidy
}
# runchecks runs all checks and is intended to run as a precommit hook.
runchecks() {
trybots "$@"
# These checks only run locally due to a limitation with TryBots.
check_shellcheck
}
# trybots runs checks supported by TryBots.
trybots() {
go_modtidy
}
usage() {
cat <