Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
Functions ¶
func DetectCPEs ¶ added in v0.40.0
func DetectCPEs(r *models.ScanResult, cpes []CPE, sesh *Session) error
DetectCPEs detects vulnerabilities for the given CPEs (CPE 2.2 URI or 2.3 FS form — typically ScanResult.Config.Scan.Servers[...].CpeNames) using the vuls2 database. OS-package / Microsoft-KB detection is suppressed here: it already ran via DetectPkgs (detector.DetectPkgCves), and running it twice would duplicate AffectedPackages on merge.
sesh is the db session to query, created with NewSession and owned (Closed) by the caller.
func DetectPkgs ¶ added in v0.40.0
func DetectPkgs(r *models.ScanResult, sesh *Session) error
DetectPkgs detects OS-package / Microsoft-KB vulnerabilities using the vuls2 database and fills ScanResult.ScannedCves. CPE-URI detection lives in DetectCPEs so the two paths (detector.DetectPkgCves for packages, detector.DetectCpeURIsCves for CPEs) can run separately without double-detecting packages.
sesh is the db session to query, created with NewSession and owned (Closed) by the caller.
func EnrichVulnInfos ¶ added in v0.39.0
func EnrichVulnInfos(r *models.ScanResult, shared *Session) error
EnrichVulnInfos enriches all ScannedCves in the ScanResult with additional vulnerability data (e.g., Red Hat API) from the vuls2 database. This should be called after all detection paths have completed.
shared is the db session to query, created with NewSession and owned (Closed) by the caller.
Types ¶
type CPE ¶ added in v0.40.0
CPE is one scanned CPE to detect (a CPE 2.2 URI or 2.3 FS string), paired with whether its matches may consult JVN. UseJVN:false suppresses JVN-source matches for this CPE — mirroring the former go-cve-dictionary UseJVN flag — so e.g. the Apple CPEs synthesised for macOS (MacOSCPEs) do not surface JVN-only detections, while user-supplied CPEs (UseJVN:true) do.
func MacOSCPEs ¶ added in v0.40.0
func MacOSCPEs(r *models.ScanResult) []CPE
MacOSCPEs synthesises the Apple CPEs for a macOS scan result: the OS (from r.Release) and each installed application bundle (from r.Packages, keyed by CFBundleIdentifier). macOS has no package security database, so the caller detects these through the CPE path (DetectCPEs). They carry UseJVN:false — Apple CPEs do not consult JVN, mirroring the former go-cve-dictionary macOS handling.
type Session ¶ added in v0.40.0
type Session struct {
// contains filtered or unexported fields
}
Session is a lazily-opened, shared vuls2 db handle scoped to one server's detection and enrichment. The db is opened at most once — on the first path that actually queries it — and reused by every later path, so the read cache that OS-package / CPE detection warms is still warm for the enrichment that immediately follows instead of being discarded and rebuilt. It is opened only when some path genuinely needs it, exactly as the unshared code did: a family that skips vuls2 detection (FreeBSD, pseudo, trivy-scanned, ...) does not open it during detection, but enrichment still opens it when the result carries CVEs (e.g. FreeBSD's pkg-audit findings); a server with nothing to detect and no CVEs to enrich never opens it at all. Create one with NewSession, thread it through DetectPkgs / DetectCPEs / EnrichVulnInfos, and Close it when the server is done. It is not safe for concurrent use; one server's detection runs sequentially, which is the intended scope.
func NewSession ¶ added in v0.40.0
NewSession returns a not-yet-opened shared Session; the db is opened lazily on the first path that queries it (see Session).
func (*Session) Close ¶ added in v0.40.0
func (s *Session) Close()
Close releases the db storage and cache if this Session was opened. It is a no-op on a nil or never-opened Session, and clears the handle afterwards so a second Close (or a stray open) neither double-closes nor reuses a closed session — always safe to defer.
Source Files
Directories