internal/worker: refactor CVE parsing logic

Logic for parsing data from a CVE is refactored and moved to various
helper functions.

Change-Id: Idd0162c6240a8ae2b1a63d3faf4d32e29e00a40c
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/362239
Trust: Julie Qiu <julie@golang.org>
Run-TryBot: Julie Qiu <julie@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Jonathan Amsterdam <jba@google.com>

internal/worker/cve.go

diff --git a/internal/worker/cve.go b/internal/worker/cve.go
index 88faac3..1272070 100644
--- a/internal/worker/cve.go
+++ b/internal/worker/cve.go
@@ -5,8 +5,8 @@
 package worker
 
 import (
+	"errors"
 	"fmt"
-	"log"
 	"net/http"
 	"net/url"
 	"strings"
@@ -16,66 +16,58 @@
 	"golang.org/x/vuln/internal/report"
 )
 
-const goGitHubRepo = "github.com/golang/go"
+const (
+	stateReserved        = "Reserved"
+	statePublicNotGoVuln = "Public - Not Go Vuln"
+	statePublicGoVuln    = "Public - Go Vuln"
+)
 
-// cveToIssue creates a cveRecord from a c *cveschema.CVE.
-func cveToIssue(c *cveschema.CVE) (_ *cve, err error) {
+var errCVEVersionUnsupported = errors.New("unsupported CVE version")
+
+// triageCVE triages the CVE and creates a cve record state.
+func triageCVE(c *cveschema.CVE) (_ *cve, err error) {
 	defer derrors.Wrap(&err, "cveToIssue(%q)", c.CVEDataMeta.ID)
-	if isPendingCVE(c) {
-		return nil, nil
+	if isReservedCVE(c) {
+		return createCVE(c, stateReserved, "", false), nil
 	}
 	switch c.DataVersion {
 	case "4.0":
-		return cveToIssueV4(c)
+		mp, err := cveModulePath(c)
+		if err != nil {
+			return nil, err
+		}
+		if mp == "" {
+			return createCVE(c, statePublicNotGoVuln, "", false), nil
+		}
+		return createCVE(c, statePublicGoVuln, mp, true), nil
 	default:
 		// TODO(https://golang.org/issue/49289): Add support for v5.0.
-		log.Printf("Unxpected data_version for CVE %q: %q (skipping)", c.CVEDataMeta.ID, c.DataVersion)
-		return nil, nil
+		return nil, fmt.Errorf("CVE %q has DataVersion %q: %w", c.CVEDataMeta.ID, c.DataVersion, errCVEVersionUnsupported)
 	}
 }
 
-func cveToIssueV4(c *cveschema.CVE) (_ *cve, err error) {
-	mp, err := modulePathFromCVE(c)
-	if err != nil {
-		return nil, err
-	}
-	if mp == "" {
-		return nil, nil
-	}
-	var links report.Links
-	for _, r := range c.References.ReferenceData {
-		if links.Commit == "" && strings.Contains(r.URL, "/commit/") {
-			links.Commit = r.URL
-		} else if links.PR == "" && strings.Contains(r.URL, "/pull/") {
-			links.PR = r.URL
-		} else {
-			links.Context = append(links.Context, r.URL)
-		}
-	}
-	var cwe string
-	for _, pt := range c.Problemtype.ProblemtypeData {
-		for _, d := range pt.Description {
-			if strings.Contains(d.Value, "CWE") {
-				cwe = d.Value
-			}
-		}
-	}
+const goGitHubRepo = "github.com/golang/go"
+
+// createCVE creates a cve record state from the data provided.
+func createCVE(c *cveschema.CVE, state string, mp string, isGoVuln bool) *cve {
 	r := &cve{
 		CVE:         *c,
-		cwe:         cwe,
+		state:       state,
+		cwe:         cveCWE(c),
 		modulePath:  mp,
-		links:       links,
+		links:       cveLinks(c),
 		description: description(c),
+		isGoVuln:    isGoVuln,
 	}
 	if mp == goGitHubRepo {
 		r.modulePath = "Standard Library"
 	}
-	return r, nil
+	return r
 }
 
 // isPendingCVE reports if the CVE is still waiting on information and not
 // ready to be triaged.
-func isPendingCVE(c *cveschema.CVE) bool {
+func isReservedCVE(c *cveschema.CVE) bool {
 	return c.CVEDataMeta.STATE == cveschema.StateReserved
 }
 
@@ -88,10 +80,10 @@
 	"golang.org":    true,
 }
 
-// modulePathFromCVE returns a Go module path for a CVE, if we can determine
-// what it is.
-func modulePathFromCVE(c *cveschema.CVE) (_ string, err error) {
-	defer derrors.Wrap(&err, "modulePathFromCVE(c)")
+// cveModulePath returns a Go module path for a CVE, if we can determine what
+// it is.
+func cveModulePath(c *cveschema.CVE) (_ string, err error) {
+	defer derrors.Wrap(&err, "cveModulePath(%q)", c.CVEDataMeta.ID)
 	for _, r := range c.References.ReferenceData {
 		if r.URL == "" {
 			continue
@@ -122,6 +114,32 @@
 	return "", nil
 }
 
+func cveLinks(c *cveschema.CVE) report.Links {
+	var links report.Links
+	for _, r := range c.References.ReferenceData {
+		if links.Commit == "" && strings.Contains(r.URL, "/commit/") {
+			links.Commit = r.URL
+		} else if links.PR == "" && strings.Contains(r.URL, "/pull/") {
+			links.PR = r.URL
+		} else {
+			links.Context = append(links.Context, r.URL)
+		}
+	}
+	return links
+}
+
+func cveCWE(c *cveschema.CVE) string {
+	var cwe string
+	for _, pt := range c.Problemtype.ProblemtypeData {
+		for _, d := range pt.Description {
+			if strings.Contains(d.Value, "CWE") {
+				cwe = d.Value
+			}
+		}
+	}
+	return cwe
+}
+
 func description(c *cveschema.CVE) string {
 	var ds []string
 	for _, d := range c.Description.DescriptionData {

internal/worker/worker.go

diff --git a/internal/worker/worker.go b/internal/worker/worker.go
index 8fff940..7aa150c 100644
--- a/internal/worker/worker.go
+++ b/internal/worker/worker.go
@@ -11,6 +11,7 @@
 	"fmt"
 	"log"
 	"path"
+	"sort"
 	"strings"
 
 	"github.com/go-git/go-git/v5"
@@ -42,12 +43,17 @@
 	if err := walkRepo(repo, root, "", t); err != nil {
 		return err
 	}
+	var newVulns []string
 	for cveID, r := range t {
 		if r.isGoVuln {
-			fmt.Println(cveID)
+			newVulns = append(newVulns, fmt.Sprintf("%s (%s)", cveID, r.modulePath))
 		}
 	}
+	sort.Strings(newVulns)
 	log.Printf("Found %d new issues from %d CVEs", t.totalVulns(), t.totalCVEs())
+	for _, v := range newVulns {
+		fmt.Println(v)
+	}
 	return nil
 }
 
@@ -81,7 +87,7 @@
 			if err != nil {
 				return err
 			}
-			issue, err := cveToIssue(c)
+			issue, err := triageCVE(c)
 			if err != nil {
 				return err
 			}