GO-2025-3767: OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr

nix

package

v0.1.6 Latest Latest Go to latest Published: Feb 5, 2025 License: Apache-2.0 Imports: 10 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/google/osv-scalibr

Links

Open Source Insights

Documentation ¶

Overview ¶

Package nix extracts packages from the Nix store directory.

Constants ¶

View Source

const (
	// Name is the unique name of this extractor.
	Name = "os/nix"
)

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Extractor ¶

type Extractor struct {
	// contains filtered or unexported fields
}

Extractor extracts packages from the nix store directory.

func New ¶

func New() *Extractor

func (Extractor) Ecosystem ¶

func (Extractor) Ecosystem(i *extractor.Inventory) string

Ecosystem returns no Ecosystem since the ecosystem is not known by OSV yet.

func (Extractor) Extract ¶

func (e Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) ([]*extractor.Inventory, error)

Extract extracts packages from the filenames of the directories in the nix store path.

func (*Extractor) FileRequired ¶

func (e *Extractor) FileRequired(api filesystem.FileAPI) bool

FileRequired returns true if a given path corresponds to a unique, unprocessed directory under the nixStoreDir path.

func (Extractor) Name ¶

func (e Extractor) Name() string

Name of the extractor.

func (Extractor) Requirements ¶

func (e Extractor) Requirements() *plugin.Capabilities

Requirements of the extractor.

func (Extractor) ToPURL ¶

func (e Extractor) ToPURL(i *extractor.Inventory) *purl.PackageURL

ToPURL converts an inventory created by this extractor into a PURL.

func (Extractor) Version ¶

func (e Extractor) Version() int

Version of the extractor.

type Metadata ¶

type Metadata struct {
	PackageName       string
	PackageVersion    string
	PackageHash       string
	PackageOutput     string
	OSID              string
	OSVersionCodename string
	OSVersionID       string
}

Metadata holds parsing information for a nix package.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL