GO-2025-3767: OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr

composerlock

package

v0.1.3 Latest Latest Go to latest Published: Sep 20, 2024 License: Apache-2.0 Imports: 10 Imported by: 0

Details

Package composerlock extracts composer.lock files.

View Source

const ComposerEcosystem string = "Packagist"

ComposerEcosystem is the OSV ecosystem for packages described in composer.lock files.

This section is empty.

This section is empty.

type Extractor struct{}

Extractor extracts composer.lock files.

func (e Extractor) Ecosystem(i *extractor.Inventory) (string, error)

Ecosystem returns the OSV Ecosystem of the software extracted by this extractor.

func (e Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) ([]*extractor.Inventory, error)

Extract extracts packages from a composer.lock file passed through the scan input.

func (e Extractor) FileRequired(path string, fileInfo fs.FileInfo) bool

FileRequired returns true if the specified file matches composer.lock files.

func (e Extractor) Name() string

Name of the extractor.

func (e Extractor) Requirements() *plugin.Capabilities

Requirements of the extractor.

func (e Extractor) ToCPEs(i *extractor.Inventory) ([]string, error)

ToCPEs is not applicable as this extractor does not infer CPEs from the Inventory.

func (e Extractor) ToPURL(i *extractor.Inventory) (*purl.PackageURL, error)

ToPURL converts an inventory created by this extractor into a PURL.

func (e Extractor) Version() int

Version of the extractor.