feat: add v1 Golang Vulncheck Analyzer#8678
Open
cvas22 wants to merge 2 commits into
Open
Conversation
Adds a new experimental analyzer that runs the Go team's `govulncheck`
against Go modules and reports the vulnerabilities it finds, sourced from
the curated Go vulnerability database.
Unlike the CPE-matching Golang Mod Analyzer, govulncheck performs call-graph
reachability analysis in source mode (`govulncheck -json ./...`), so it
reports primarily the vulnerabilities actually reachable from the scanned
code - substantially reducing false positives/negatives for Go.
Design:
- Source mode only, keyed off `go.mod` (reuses existing module detection);
binary mode is intentionally out of scope for v1.
- Native `-json` (OSV) output; streaming parser joins `osv` advisories with
`finding` records and selects the most precise (reachable) finding.
- De-duplicates against other data sources via OSV aliases: reuses an
existing NVD vulnerability when a CVE alias matches, otherwise synthesizes
one under the GO-YYYY-NNNN id.
- Reports against the vulnerable module as a synthetic pkg:golang dependency.
Disabled by default; requires `go` and `govulncheck` to be installed.
New:
- GolangVulncheckAnalyzer, GovulncheckProcessor
- GovulncheckJsonParser, GovulncheckResult
- Settings keys analyzer.golang.vulncheck.{enabled,path}
- Vulnerability.Source.GOVULNCHECK
Config wiring: CLI (--enableGolangVulncheck, --govulncheck), Ant
(golangVulncheckEnabled, pathToGovulncheck), Maven (golangVulncheckEnabled,
pathToGovulncheck).
Tests: unit tests for the parser and analyzer; an integration test that runs
real govulncheck end-to-end (self-skips when the tool is absent).
Docs: analyzer page, analyzers index, CLI/Ant/Maven configuration, and bash
completion updated.
feat: add experimental Golang Vulncheck Analyzer (dependency-check#8470)
boring-cyborg
Bot
added
ant
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of Change
Adds a new v1 analyzer that runs the Go team's govulncheck against Go modules and reports the vulnerabilities it finds, sourced from the curated Go vulnerability database.
Unlike the CPE-matching Golang Mod Analyzer, govulncheck performs call-graph reachability analysis in source mode (govulncheck -json ./...), so it reports primarily the vulnerabilities actually reachable from the scanned code - substantially reducing false positives/negatives for Go.
Design:
Source mode only, keyed off go.mod (reuses existing module detection); binary mode is intentionally out of scope for v1.
Native -json (OSV) output; streaming parser joins osv advisories with finding records and selects the most precise (reachable) finding.
De-duplicates against other data sources via OSV aliases: reuses an existing NVD vulnerability when a CVE alias matches, otherwise synthesizes one under the GO-YYYY-NNNN id.
Reports against the vulnerable module as a synthetic pkg:golang dependency.
Disabled by default; requires go and govulncheck to be installed.
New:
GolangVulncheckAnalyzer, GovulncheckProcessor
GovulncheckJsonParser, GovulncheckResult
Settings keys analyzer.golang.vulncheck.{enabled,path}
Vulnerability.Source.GOVULNCHECK
Config wiring: CLI (--enableGolangVulncheck, --govulncheck), Ant (golangVulncheckEnabled, pathToGovulncheck), Maven (golangVulncheckEnabled, pathToGovulncheck).
Tests: unit tests for the parser and analyzer; an integration test that runs real govulncheck end-to-end (self-skips when the tool is absent).
Docs: analyzer page, analyzers index, CLI/Ant/Maven configuration, and bash completion updated.
Related issues
attempts to address #8470
Have test cases been added to cover the new functionality?
yes