nvd

package
v0.0.24 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 11, 2026 License: MIT Imports: 7 Imported by: 0

README

Bounded NVD lookups

GetCVEContext(ctx, id) propagates cancellation and uses a 10-second maximum request deadline. The shared HTTP client also has a 10-second timeout covering connection setup, headers, and the full response body. An earlier caller deadline wins. GetCVE(id) remains source-compatible and uses the same limit with a background context. The vulnerability package similarly exposes the additive GetVulnerabilityContext helper and retains GetVulnerability.

Consumers must bound a batch once, not renew the budget for every CVE. The scanner and host-ingest API use a 30-second total enrichment budget per host. A metadata timeout is best-effort: preserve detected findings and stop further lookups once the budget expires. Scanner cancellation is distinct: return the context error (with the detected findings) so cancellation is not reported as success.

API handlers derive their budget from Fiber UserContext. This respects a middleware-supplied cancellation/deadline, but does not claim that Fiber cancels on client disconnect. The explicit budget also covers requests without such middleware. The budget bounds NVD work, not database operations.

Release order

These SDK additions must be published before consumer dependency pins are moved. The scanner's development replacement uses the local SDK. The Sirius API's pinned SDK does not yet contain the context helpers; a temporary Go workspace is suitable for local verification but is not a release solution. Publish the additive SDK, update each consumer to that immutable version, verify clean builds without local replacements/workspaces, then release consumers. Do not substitute a local replace for the consumer release pin.

Tests

go test -race ./nvd uses synthetic transports only. It covers canceled and stalled headers/body, earlier caller deadlines, the finite legacy default, HTTP and decode failures, and the existing empty-result contract. Scanner and API TestNVD* tests cover multi-CVE budgets, cancellation, and preserving existing findings without running scans or contacting NVD. When running consumer package tests, isolate their unrelated database initialization using a nonexistent Unix socket directory and disable schema auto-migration/reset.

Documentation

Index

Constants

View Source 
const DefaultRequestTimeout = 10 * time.Second

DefaultRequestTimeout bounds a lookup, including response headers and body.

Variables

This section is empty.

Functions

This section is empty.

Types

type Config 

type Config struct {
	Operator string `json:"operator"`
	Negate   bool   `json:"negate,omitempty"`
	Nodes    []Node `json:"nodes"`
}

"configurations" array items

type CpeMatch 

type CpeMatch struct {
	Vulnerable            bool   `json:"vulnerable"`
	Criteria              string `json:"criteria"`
	MatchCriteriaID       string `json:"matchCriteriaId"`
	VersionStartExcluding string `json:"versionStartExcluding,omitempty"`
	VersionStartIncluding string `json:"versionStartIncluding,omitempty"`
	VersionEndExcluding   string `json:"versionEndExcluding,omitempty"`
	VersionEndIncluding   string `json:"versionEndIncluding,omitempty"`
}

An item in "cpeMatch"

type CveItem 

type CveItem struct {
	ID                    string          `json:"id"`
	SourceIdentifier      string          `json:"sourceIdentifier"`
	VulnStatus            string          `json:"vulnStatus"`
	Published             string          `json:"published"`
	LastModified          string          `json:"lastModified"`
	EvaluatorComment      *string         `json:"evaluatorComment,omitempty"`
	EvaluatorSolution     *string         `json:"evaluatorSolution,omitempty"`
	EvaluatorImpact       *string         `json:"evaluatorImpact,omitempty"`
	CisaExploitAdd        *string         `json:"cisaExploitAdd,omitempty"`
	CisaActionDue         *string         `json:"cisaActionDue,omitempty"`
	CisaRequiredAction    *string         `json:"cisaRequiredAction,omitempty"`
	CisaVulnerabilityName *string         `json:"cisaVulnerabilityName,omitempty"`
	CveTags               []CveTag        `json:"cveTags,omitempty"`
	Descriptions          []LangString    `json:"descriptions"`
	References            []Reference     `json:"references"`
	Metrics               Metrics         `json:"metrics,omitempty"`
	Weaknesses            []Weakness      `json:"weaknesses,omitempty"`
	Configurations        []Config        `json:"configurations,omitempty"`
	VendorComments        []VendorComment `json:"vendorComments,omitempty"`
}

CVE object per NVD schema

func GetCVE 

func GetCVE(vid string) (CveItem, error)

GetCVE preserves the legacy API with a bounded background lookup.

func GetCVEContext added in v0.0.20 

func GetCVEContext(ctx context.Context, vid string) (CveItem, error)

GetCVEContext fetches NVD metadata within the caller's deadline and the per-request limit. Cancellation interrupts header and response-body reads.

type CveTag 

type CveTag struct {
	SourceIdentifier string   `json:"sourceIdentifier"`
	Tags             []string `json:"tags"`
}

Each object in "cveTags"

type CvssDataV2 

type CvssDataV2 struct {
	Version               string  `json:"version"`
	VectorString          string  `json:"vectorString"`
	BaseScore             float64 `json:"baseScore"`
	AccessVector          string  `json:"accessVector"`
	AccessComplexity      string  `json:"accessComplexity"`
	Authentication        string  `json:"authentication"`
	ConfidentialityImpact string  `json:"confidentialityImpact"`
	IntegrityImpact       string  `json:"integrityImpact"`
	AvailabilityImpact    string  `json:"availabilityImpact"`
}

CVSS v2.0 data

type CvssDataV30 

type CvssDataV30 struct {
	Version               string  `json:"version"`
	VectorString          string  `json:"vectorString"`
	BaseScore             float64 `json:"baseScore"`
	BaseSeverity          string  `json:"baseSeverity"`
	AttackVector          string  `json:"attackVector"`
	AttackComplexity      string  `json:"attackComplexity"`
	PrivilegesRequired    string  `json:"privilegesRequired"`
	UserInteraction       string  `json:"userInteraction"`
	Scope                 string  `json:"scope"`
	ConfidentialityImpact string  `json:"confidentialityImpact"`
	IntegrityImpact       string  `json:"integrityImpact"`
	AvailabilityImpact    string  `json:"availabilityImpact"`
}

CVSS v3.0 data

type CvssDataV31 

type CvssDataV31 struct {
	Version               string  `json:"version"`
	VectorString          string  `json:"vectorString"`
	BaseScore             float64 `json:"baseScore"`
	BaseSeverity          string  `json:"baseSeverity"`
	AttackVector          string  `json:"attackVector"`
	AttackComplexity      string  `json:"attackComplexity"`
	PrivilegesRequired    string  `json:"privilegesRequired"`
	UserInteraction       string  `json:"userInteraction"`
	Scope                 string  `json:"scope"`
	ConfidentialityImpact string  `json:"confidentialityImpact"`
	IntegrityImpact       string  `json:"integrityImpact"`
	AvailabilityImpact    string  `json:"availabilityImpact"`
}

CVSS v3.1 data

type CvssDataV40 

type CvssDataV40 struct {
	// For full parity, define fields from https://csrc.nist.gov/schema/nvd/api/2.0/external/cvss-v4.0.json
	// This example structure only shows typical fields from sample data; expand as needed.
	Version      string `json:"version"`
	VectorString string `json:"vectorString"`
}

CVSS v4.0 data

type CvssV2 

type CvssV2 struct {
	Source                  string     `json:"source"`
	Type                    string     `json:"type"`
	CvssData                CvssDataV2 `json:"cvssData"`
	BaseSeverity            *string    `json:"baseSeverity,omitempty"`
	ExploitabilityScore     *float64   `json:"exploitabilityScore,omitempty"`
	ImpactScore             *float64   `json:"impactScore,omitempty"`
	AcInsufInfo             *bool      `json:"acInsufInfo,omitempty"`
	ObtainAllPrivilege      *bool      `json:"obtainAllPrivilege,omitempty"`
	ObtainUserPrivilege     *bool      `json:"obtainUserPrivilege,omitempty"`
	ObtainOtherPrivilege    *bool      `json:"obtainOtherPrivilege,omitempty"`
	UserInteractionRequired *bool      `json:"userInteractionRequired,omitempty"`
}

CVSS v2.0

type CvssV30 

type CvssV30 struct {
	Source              string      `json:"source"`
	Type                string      `json:"type"`
	CvssData            CvssDataV30 `json:"cvssData"`
	ExploitabilityScore float64     `json:"exploitabilityScore,omitempty"`
	ImpactScore         float64     `json:"impactScore,omitempty"`
}

CVSS v3.0

type CvssV31 

type CvssV31 struct {
	Source              string      `json:"source"`
	Type                string      `json:"type"`
	CvssData            CvssDataV31 `json:"cvssData"`
	ExploitabilityScore float64     `json:"exploitabilityScore,omitempty"`
	ImpactScore         float64     `json:"impactScore,omitempty"`
}

CVSS v3.1

type CvssV40 

type CvssV40 struct {
	Source   string      `json:"source"`
	Type     string      `json:"type"`
	CvssData CvssDataV40 `json:"cvssData"`
}

CVSS v4.0

type DefCVEItem 

type DefCVEItem struct {
	CVE CveItem `json:"cve"`
}

An item in the "vulnerabilities" array

type LangString 

type LangString struct {
	Lang  string `json:"lang"`
	Value string `json:"value"`
}

"descriptions" array items

type Metrics 

type Metrics struct {
	CvssMetricV40 []CvssV40 `json:"cvssMetricV40,omitempty"`
	CvssMetricV31 []CvssV31 `json:"cvssMetricV31,omitempty"`
	CvssMetricV30 []CvssV30 `json:"cvssMetricV30,omitempty"`
	CvssMetricV2  []CvssV2  `json:"cvssMetricV2,omitempty"`
}

Container for multiple CVSS versions

type NVDResponse 

type NVDResponse struct {
	ResultsPerPage  int          `json:"resultsPerPage"`
	StartIndex      int          `json:"startIndex"`
	TotalResults    int          `json:"totalResults"`
	Format          string       `json:"format"`
	Version         string       `json:"version"`
	Timestamp       string       `json:"timestamp"`
	Vulnerabilities []DefCVEItem `json:"vulnerabilities"`
}

Top-level response

type Node 

type Node struct {
	Operator string     `json:"operator"`
	Negate   bool       `json:"negate,omitempty"`
	CpeMatch []CpeMatch `json:"cpeMatch,omitempty"`
}

Each node in "configurations"

type Reference 

type Reference struct {
	URL    string   `json:"url"`
	Source string   `json:"source,omitempty"`
	Tags   []string `json:"tags,omitempty"`
}

"references" array items

type VendorComment 

type VendorComment struct {
	Organization string `json:"organization"`
	Comment      string `json:"comment"`
	LastModified string `json:"lastModified"`
}

"vendorComments" array items

type Weakness 

type Weakness struct {
	Source      string       `json:"source"`
	Type        string       `json:"type"`
	Description []LangString `json:"description"`
}

"weaknesses" array items

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.