tree c117ec85f149fb31e3eb18e456aba90657b8d969
parent b749fb1239457c420c24938dfbe733e9e75625b8
author Jonathan Amsterdam <jba@google.com> 1647033086 -0500
committer Julie Qiu <julie@golang.org> 1648067536 +0000

cmd/govulncheck: select representative symbols more carefully

Instead of using the entries (top of call stacks) as the symbols to
show to the user, use the lowest symbols on the call stacks from the
packages under analysis. This can greatly reduce the number of symbols.

For example, in k8s.io/kubernetes, many functions call
k8s.io/kubernetes/pkg/util/selinux.SELinuxEnabled, which then calls a
vulnerable symbol in github.com/opencontainers/selinux/go-selinux.

In this particular case, this CL reduces the number of
symbols from 2,384 to 2.

Cherry-picked: https://go-review.googlesource.com/c/exp/+/391894

Change-Id: Ib191cb8ec6a09e607673af7ccdcb34ea121a5b69
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/395240
Trust: Julie Qiu <julie@golang.org>
Run-TryBot: Julie Qiu <julie@golang.org>
Reviewed-by: Jonathan Amsterdam <jba@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>