tree 2f41858dec171e8ebebc90ddb238c9a2691a0462
parent aaef6dbbfd827cd314d6b08f589a5a751f1fedd4
author Hana <hyangah@gmail.com> 1647033090 -0500
committer Hyang-Ah Hana Kim <hyangah@gmail.com> 1647883959 +0000

vulncheck: remove isLocal check from fetchVulnerabilities

isLocal check was added to improve efficiency by avoiding
fetch of data that's not going to be used. Version info is
inaccurate or unavailable for modules that are in writable
local directories so vuln check for those modules are skipped
anyway.

With the check, fetchVulnerabilities excludes vulnerabilities
for modules if their source files are outside the module cache.
The location of the module cache was determined by querying
GOMODCACHE and GOPATH environment variables of the govulncheck
process. That worked well for govulncheck when it is used
for source scanning.

The logic was copied to vulncheck API internal. However,
relying on process's GOMODCACHE/GOPATH environment variables
limit the API's utility. For example, Gopls may use different
GOMODCACHE/GOPATH for each workspace it's processing and they
can be different from the Gopls's own GOMODCACHE/GOPATH env vars.
Test data can be loaded with a fake GOMODCACHE that's different
from the GOMODCACHE env var of the test process.

There was an escape flag to skip this check to work with
the test environment where the module cache and GOPATH
are different from the test process's. But that is unexported;
external packages cannot utilize it and that prevents
writing tests from external packages.

This CL proposes to remove the isLocal check. There is already
a cache that reduces volume of data fetch over network, and
vulncheck can potentially address the efficiency issue in different
ways. Users and applications that need to exclude
vulnerabilities of local modules, may utilize
golang.org/x/vuln/client.Client
and implement filtering from GetByModule. Or, if this problem
is common, we may consider an explicit setting in the
vulncheck.Config.

Change-Id: Iced93351b91a00fdc623a6d1c3076da86fbe2c70
Reviewed-on: https://go-review.googlesource.com/c/exp/+/391914
Trust: Hyang-Ah Hana Kim <hyangah@gmail.com>
Run-TryBot: Hyang-Ah Hana Kim <hyangah@gmail.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>