tree 735290ba51dcbeb7b144d44677ee3302a2633f1e
parent 5cb4fee858ee0745099079eea6fad206f604f86d
author Zvonimir Pavlinovic <zpavlinovic@google.com> 1632333377 -0700
committer Zvonimir Pavlinovic <zpavlinovic@google.com> 1633718017 +0000

vulndb/internal/audit: filter affected fields in vulnerabilities

Filtering of vulnerabilities did not filter affected fields. This can
lead to false positives. For instance, filtering would deem a
vulnerability applicable to the current user code if a single affected
field applies to it. Other affected fields would be kept too even though
they might not apply to the code. If the code uses packages and symbols
related to these non-applicable affected fields, audit will report them.
The most prominent example of this is YAML vulnerability. This CL
filters affected fields as well.

Change-Id: I92a521a7eeadf12376a3c42f4fe69769ee1c3637
Reviewed-on: https://go-review.googlesource.com/c/exp/+/351454
Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Julie Qiu <julie@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Trust: Julie Qiu <julie@golang.org>