| commit | 42b5a4503a5376834e93ca2d7f163a90d96cdf63 | [log] [tgz] |
|---|---|---|
| author | Zvonimir Pavlinovic <zpavlinovic@google.com> | Wed Mar 17 17:57:56 2021 -0700 |
| committer | Filippo Valsorda <valsorda@google.com> | Tue Apr 13 16:18:34 2021 +0200 |
| tree | 4ca7fbb2c31124eafbd167847d4cc48cac7a8c40 | |
| parent | abe7a418aeab38d4023c4a54a07b59a6c4ecbaac [diff] |
report: fixes a nil dereference when accessing vuln cve metadata. Some vulnerabilities, such as GO-2020-0002.toml, do not have CVE metadata. Accessing CVEMetadata.ID without checking if CVEMetadata is nil can lead to a nil dereference. Change-Id: I06a24a7d80a0e8be768af198a1b6254f15de98d3 Reviewed-on: https://team-review.git.corp.google.com/c/golang/vulndb/+/1026682 Reviewed-by: Roland Shoemaker <bracewell@google.com>
This repository contains a handful of prototypes for the Go vulnerability database, as well as a initial set of vulnerability reports. Some of these packages can probably be coalesced, but for now are easier to work on in a more segmented fashion.
reports contains TOML security reports, the format is described in format.mdreport provides a package for parsing and linting TOML reportsosv provides a package for generating OSV-style JSON vulnerability entries from a report.Reportclient contains a client for accesing HTTP/fs based vulnerability databases, as well as a minimal caching implementationcmd/gendb provides a tool for converting TOML reports into JSON databasecmd/genhtml provides a tool for converting TOML reports into a HTML websitecmd/linter provides a tool for linting individual reportscmd/report2cve provides a tool for converting TOML reports into JSON CVEs