Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CompareMavenVersions ¶ added in v0.3.0
CompareMavenVersions is a best-effort Maven version comparator: it splits on '.' and '-' and compares each segment numerically when both sides parse as integers, falling back to lexical comparison otherwise. It does not implement Maven's qualifier ordering (e.g. alpha < beta < milestone < rc < (release) < sp) - only good enough to pick a plausible "newer" fix version. Exported for reuse by the Java/Maven ecosystem's own bump-filtering logic.
func EnsureVPrefix ¶ added in v0.3.0
EnsureVPrefix normalizes a version string for golang.org/x/mod/semver, which requires a "v" prefix. Exported for reuse by ecosystems comparing semver-ish versions (e.g. crates.io versions, which lack the prefix).
func SeverityRank ¶ added in v0.3.0
SeverityRank orders severity labels most-critical-first for sorting: CRITICAL < HIGH < MEDIUM < LOW < everything else (UNKNOWN, empty).
Types ¶
type Package ¶ added in v0.3.0
type Package struct {
Name string // OSV package name: Go module path, bare crate name, "groupId:artifactId", etc.
Version string
Ecosystem string // OSV.dev ecosystem id: "Go", "crates.io", "Maven", ...
}
Package identifies a single dependency to query OSV for. Version may carry a leading "v" (Go's convention) or not (most other ecosystems') - it is normalized internally as needed for comparison.
type ScanResult ¶
type ScanResult struct {
Vulnerabilities []Vulnerability `json:"vulnerabilities"`
SecurityBumps []SecurityBump `json:"security_bumps"`
Error string `json:"error,omitempty"`
}
ScanResult contains the results of a vulnerability scan
func (*ScanResult) GetCriticalCount ¶
func (result *ScanResult) GetCriticalCount() int
GetCriticalCount returns count of critical vulnerabilities
func (*ScanResult) GetHighCount ¶
func (result *ScanResult) GetHighCount() int
GetHighCount returns count of high severity vulnerabilities
func (*ScanResult) HasSecurityBumps ¶
func (result *ScanResult) HasSecurityBumps() bool
HasSecurityBumps checks if scan result has security bumps to apply
func (*ScanResult) HasVulnerabilities ¶
func (result *ScanResult) HasVulnerabilities() bool
HasVulnerabilities checks if scan result contains any vulnerabilities
type SecurityBump ¶ added in v0.3.0
type SecurityBump struct {
Name string `json:"name"`
Ecosystem string `json:"ecosystem"`
CurrentVersion string `json:"current_version"`
FixedVersion string `json:"fixed_version"`
VulnIDs []string `json:"vuln_ids,omitempty"` // advisories addressed by this bump
}
SecurityBump is a recommended fix: bump Name from CurrentVersion to FixedVersion.
type Vulnerability ¶
type Vulnerability struct {
ID string `json:"id"`
Module string `json:"module"`
Ecosystem string `json:"ecosystem"`
CurrentVersion string `json:"current_version"`
FixedVersion string `json:"fixed_version,omitempty"`
Severity string `json:"severity,omitempty"`
Summary string `json:"summary,omitempty"`
DatabaseSpecific any `json:"database_specific,omitempty"`
// VulnerableImports are the packages the vulnerable code actually lives
// in, from the Go vulndb's ecosystem_specific.imports metadata (Go
// advisories only; empty when the record carries none). Consumers use
// this for artifact-level reachability: a module can be linked into a
// binary while the specific vulnerable package is not.
VulnerableImports []VulnerableImport `json:"vulnerable_imports,omitempty"`
}
Vulnerability represents a security vulnerability with fix information
type VulnerabilityCache ¶
type VulnerabilityCache struct {
// contains filtered or unexported fields
}
VulnerabilityCache provides a thread-safe cache for vulnerability scan results to avoid redundant API calls for the same package@version combinations within a single run. Cached values are shared pointers returned directly to callers - treat them as read-only; mutating a cached *osvschema.Vulnerability corrupts every other holder.
func GetGlobalCache ¶
func GetGlobalCache() *VulnerabilityCache
GetGlobalCache returns the shared global vulnerability cache
func NewVulnerabilityCache ¶
func NewVulnerabilityCache() *VulnerabilityCache
NewVulnerabilityCache creates a new vulnerability cache
func (*VulnerabilityCache) Clear ¶
func (c *VulnerabilityCache) Clear()
Clear removes all entries from the cache
func (*VulnerabilityCache) Get ¶
func (c *VulnerabilityCache) Get(key string) ([]*osvschema.Vulnerability, bool)
Get retrieves cached vulnerability results for a package@version key Returns the vulnerabilities and true if found, empty slice and false if not found
func (*VulnerabilityCache) Set ¶
func (c *VulnerabilityCache) Set(key string, vulns []*osvschema.Vulnerability)
Set stores vulnerability results for a package@version key
func (*VulnerabilityCache) Size ¶
func (c *VulnerabilityCache) Size() int
Size returns the number of entries in the cache
type VulnerabilityScanner ¶
type VulnerabilityScanner struct {
// contains filtered or unexported fields
}
VulnerabilityScanner handles scanning package dependencies for security vulnerabilities
func NewVulnerabilityScanner ¶
func NewVulnerabilityScanner(httpClient *http.Client) *VulnerabilityScanner
NewVulnerabilityScanner creates a new vulnerability scanner with the global cache The httpClient parameter is required and should be obtained from httpclient.NewHTTPClient()
func (*VulnerabilityScanner) ScanPackages ¶ added in v0.3.0
func (vs *VulnerabilityScanner) ScanPackages(ctx context.Context, pkgs []Package) (*ScanResult, error)
ScanPackages scans a set of packages for known vulnerabilities via the OSV batch API, using the cache to avoid duplicate lookups within a run. This is the ecosystem-agnostic entry point: callers (one per language) are responsible for turning their own manifest format into a []Package list, having already applied any ecosystem-specific rewriting (e.g. Go's replace directives, or skipping local/vendored dependencies).
type VulnerableImport ¶ added in v0.3.0
type VulnerableImport struct {
Path string `json:"path,omitempty"`
GOOS []string `json:"goos,omitempty"`
}
VulnerableImport is one ecosystem_specific.imports entry of a Go advisory: the import path containing the vulnerable code, and the platforms it is constrained to (empty GOOS = all platforms).
Source Files