Documentation
¶
Overview ¶
Package reachability runs tree-sitter S-expression queries supplied by vdb-manager against source files to determine whether a known- vulnerable code pattern is present (direct mode) or reachable from first-party code (transitive mode).
Index ¶
Constants ¶
const MaxFileSize = 4 * 1024 * 1024 // 4 MiB
MaxFileSize is the largest file the scanner will parse. Files above this threshold are silently skipped to keep memory bounded.
Variables ¶
This section is empty.
Functions ¶
func InstallPath ¶
InstallPath attempts to locate the on-disk directory for a given (ecosystem, package) pair starting from projectRoot. The lookup is purely filesystem-based: no package manager is invoked. Returns "" if nothing plausible is found.
Each ecosystem has a canonical install layout. For monorepos or non-standard layouts the caller can still surface transitive matches even when this lookup fails.
Types ¶
type Engine ¶
type Engine struct {
// contains filtered or unexported fields
}
Engine compiles and runs tree-sitter queries against source files. It is safe for concurrent use; parsers are not shared but are pooled per language.
func (*Engine) Run ¶
func (e *Engine) Run(ctx context.Context, id treesitter.LanguageID, source []byte, queryText string) ([]QueryMatch, error)
Run parses source as the given language and executes queryText against it, returning every top-level match.
type Match ¶
type Match struct {
File string `json:"file"`
StartLine int `json:"start_line"`
EndLine int `json:"end_line"`
Query string `json:"query,omitempty"`
Language string `json:"language,omitempty"`
Captures map[string]string `json:"captures,omitempty"`
}
Match is one tree-sitter query hit recorded against a file.
type Mode ¶
type Mode string
Mode selects which scans are performed.
type QueryMatch ¶
QueryMatch is a single match emitted by Engine.Run before being promoted to a reachability.Match (which adds file context).
type Result ¶
type Result struct {
Direct []Match `json:"direct,omitempty"`
Transitive []Match `json:"transitive,omitempty"`
// Skipped is populated when a mode was requested but couldn't run,
// e.g. the package install folder couldn't be located.
SkippedDirect string `json:"skipped_direct,omitempty"`
SkippedTransitive string `json:"skipped_transitive,omitempty"`
// QueriesRun is the count of distinct query/language pairs executed.
QueriesRun int `json:"queries_run"`
}
Result is the full reachability output for a single vulnerability.
type ScanRequest ¶
type ScanRequest struct {
ProjectRoot string
Ecosystem string
Package string
// Queries from vdb-api's GET /vuln/{id}/tree-sitter response.
Queries []vdb.TreeSitterQuery
Mode Mode
}
ScanRequest groups the inputs to one reachability scan.
Source Files