GO-2025-3767: OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr

homebrew

package

v0.2.0 Latest Latest Go to latest Published: Apr 23, 2025 License: Apache-2.0 Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/google/osv-scalibr

Links

Open Source Insights

Documentation ¶

Overview ¶

Package homebrew extracts package information from OSX homebrew INSTALL_RECEIPT.json files.

Constants ¶

View Source

const (
	// Name is the unique name of this extractor.
	Name = "os/homebrew"
)

Variables ¶

This section is empty.

Functions ¶

func New ¶ added in v0.1.7

func New() filesystem.Extractor

New returns a new instance of the extractor.

Types ¶

type BrewPath ¶

type BrewPath struct {
	AppName    string
	AppVersion string
	AppFile    string
	AppExt     string
}

BrewPath struct holds homebrew package information from homebrew package path. ../${appClass}/${appName}/${version}/${appFile} e.g. ../Caskroom/firefox/1.1/firefox.wrapper.sh or ../Cellar/tree/1.1/INSTALL_RECEIPT.json

func SplitPath ¶

func SplitPath(path string) *BrewPath

SplitPath takes the package path and splits it into its recognised struct components

type Extractor ¶

type Extractor struct{}

Extractor extracts software details from a OSX Homebrew package path.

func (Extractor) Ecosystem ¶

func (Extractor) Ecosystem(p *extractor.Package) string

Ecosystem returns no Ecosystem since the ecosystem is not known by OSV yet.

func (Extractor) Extract ¶

func (e Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) (inventory.Inventory, error)

Extract parses the recognised Homebrew file path and returns information about the installed package.

func (Extractor) FileRequired ¶

func (e Extractor) FileRequired(api filesystem.FileAPI) bool

FileRequired returns true if the specified file path matches the homebrew path.

func (Extractor) Name ¶

func (e Extractor) Name() string

Name of the extractor.

func (Extractor) Requirements ¶

func (e Extractor) Requirements() *plugin.Capabilities

Requirements of the extractor.

func (Extractor) ToPURL ¶

func (e Extractor) ToPURL(p *extractor.Package) *purl.PackageURL

ToPURL converts a package created by this extractor into a PURL.

func (Extractor) Version ¶

func (e Extractor) Version() int

Version of the extractor.

type Metadata ¶ added in v0.1.6

type Metadata struct{}

Metadata is the metadata struct for information relating to the homebrew package.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL