GO-2025-3767: OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr

pomxmlnet

package

v0.1.6 Latest Latest Go to latest Published: Feb 5, 2025 License: Apache-2.0 Imports: 16 Imported by: 2

Details

Package pomxmlnet extracts Maven's pom.xml format with transitive dependency resolution.

This section is empty.

This section is empty.

This section is empty.

type Extractor struct {
	client.DependencyClient
	*datasource.MavenRegistryAPIClient
}

Extractor extracts Maven packages with transitive dependency resolution.

func (e Extractor) Ecosystem(_ *extractor.Inventory) string

Ecosystem returns the OSV ecosystem ('npm') of the software extracted by this extractor.

func (e Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) ([]*extractor.Inventory, error)

Extract extracts packages from yarn.lock files passed through the scan input.

func (e Extractor) FileRequired(fapi filesystem.FileAPI) bool

FileRequired never returns true, as this is for the osv-scanner json output.

func (e Extractor) Name() string

Name of the extractor.

func (e Extractor) Requirements() *plugin.Capabilities

Requirements of the extractor.

func (e Extractor) ToPURL(i *extractor.Inventory) *purl.PackageURL

ToPURL converts an inventory created by this extractor into a PURL.

func (e Extractor) Version() int

Version of the extractor.