report: fixes a nil dereference when accessing vuln cve metadata.
Some vulnerabilities, such as GO-2020-0002.toml, do not have CVE
metadata. Accessing CVEMetadata.ID without checking if CVEMetadata is
nil can lead to a nil dereference.
Change-Id: I06a24a7d80a0e8be768af198a1b6254f15de98d3
Reviewed-on: https://team-review.git.corp.google.com/c/golang/vulndb/+/1026682
Reviewed-by: Roland Shoemaker <bracewell@google.com>
diff --git a/report/report.go b/report/report.go
index 6c52a0c..8839cd8 100644
--- a/report/report.go
+++ b/report/report.go
@@ -105,7 +105,7 @@
return fmt.Errorf("unknown severity %q", vuln.Severity)
}
- if vuln.CVE != "" && vuln.CVEMetadata.ID != "" {
+ if vuln.CVE != "" && vuln.CVEMetadata != nil && vuln.CVEMetadata.ID != "" {
// TODO: may just want to use one of these? :shrug:
return errors.New("only one of cve and cve_metadata.id should be present")
}
