tree 07d5340ced86b8097d10ad5329ee0fcc1d4a1770
parent d71ffde246e8627d5a359f3fcacbdfcc7d078800
author Jonathan Amsterdam <jba@google.com> 1639394139 -0500
committer Jonathan Amsterdam <jba@google.com> 1639426176 +0000

internal/worker: handle false positive changes

Add a triage state for false positives. When determining whether
a changed CVE with false-positive state needs an issue, ignore
the reference URLs we already know about.

Here is the scenario this CL is designed to address:

1. A CVE is a known false positive, meaning that although it has a
   reference URL that suggests Go is involved, we know it isn't. We
   initialize the DB with it.

2. In a later commit, the CVE changes. Perhaps references are added.

3. On the next update, the triage algorithm will match the same
   URLs that triggered it the first time, and we will change the state
   to NeedsIssue.

By distinguishing the states NoActionNeeded and FalsePositive, and
remembering the reference URLs that were used when the false positive
was identified, we can avoid this. But if a new, Go-relevant URLs is
added, we'll see that it's not in our list and then, validly, re-label
the CVE as NeedsIssue.

Also, add a HasVuln state for CVEs that are already covered
by existing Go vulnerability reports. Even though we check
the Go vulndb when we triage, we need to represent
these specially because the Go vuln report can mention only
one CVE, so other matching ones must be handled this way.

Change-Id: I3c67a8c8911b261a376a64fcc7f54f387c2bd457
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/370838
Trust: Jonathan Amsterdam <jba@google.com>
Run-TryBot: Jonathan Amsterdam <jba@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Julie Qiu <julie@golang.org>