tree 213fe73528770f9ef7fe152a36be1dabb25b9047
parent bd4e8a33fc32d17070e0402b7186d2fde8ca0c1f
author Zvonimir Pavlinovic <zpavlinovic@google.com> 1630452157 -0700
committer Zvonimir Pavlinovic <zpavlinovic@google.com> 1630623593 +0000

vulndb/internal/audit: filter out vulns for modules with "" version

When a module version is unknown (""), the current implementation assumes
that any vulnerability version range applies to it. This can lead to
false alarms, the most prominent example being when audit is run on a
top-level module (which will have "" version) that has known
vulnerabilities. This CL makes sure no vulnerabilities apply for a
module with an unavailable version.

Fixes golang/go#48079

Change-Id: Idd9f080f9037d105d86311b62de77f29ef4664a2
Reviewed-on: https://go-review.googlesource.com/c/exp/+/346609
Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Trust: Zvonimir Pavlinovic <zpavlinovic@google.com>