// Copyright 2022 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package main

import (
	"encoding/json"
	"log"
	"os"

	"github.com/google/go-cmp/cmp"
	"golang.org/x/vuln/vulncheck"
)

const usage = `test helper for examining the output of running govulncheck on k8s@v1.15.11.

Example usage: ./k8s [path to output file]
`

func main() {
	if len(os.Args) != 2 {
		log.Fatal("Incorrect number of expected command line arguments", usage)
	}
	out := os.Args[1]

	outJson, err := os.ReadFile(out)
	if err != nil {
		log.Fatal("Failed to read:", out)
	}

	var r vulncheck.Result
	if err := json.Unmarshal(outJson, &r); err != nil {
		log.Fatal("Failed to load json into vulncheck.Result:", err)
	}

	if len(r.Vulns) != 47 {
		log.Fatalf("want 47 vulns; got %d", len(r.Vulns))
	}

	type vuln struct {
		pkg    string
		symbol string
	}
	calledVulns := make(map[vuln]bool)
	for _, v := range r.Vulns {
		calledVulns[vuln{v.PkgPath, v.Symbol}] = true
	}

	want := map[vuln]bool{
		{"github.com/containernetworking/cni/pkg/invoke", "FindInPath"}:               true,
		{"github.com/evanphx/json-patch", "partialArray.add"}:                         true,
		{"github.com/opencontainers/selinux/go-selinux", "CurrentLabel"}:              true,
		{"github.com/opencontainers/selinux/go-selinux", "FileLabel"}:                 true,
		{"github.com/opencontainers/selinux/go-selinux", "GetEnabled"}:                true,
		{"github.com/opencontainers/selinux/go-selinux", "SetFileLabel"}:              true,
		{"github.com/opencontainers/selinux/go-selinux", "getSelinuxMountPoint"}:      true,
		{"github.com/opencontainers/selinux/go-selinux", "lgetxattr"}:                 true,
		{"github.com/opencontainers/selinux/go-selinux", "lsetxattr"}:                 true,
		{"github.com/opencontainers/selinux/go-selinux", "readCon"}:                   true,
		{"github.com/opencontainers/selinux/go-selinux", "selinuxState.getEnabled"}:   true,
		{"github.com/opencontainers/selinux/go-selinux", "selinuxState.getSELinuxfs"}: true,
		{"github.com/opencontainers/selinux/go-selinux", "selinuxState.setEnable"}:    true,
		{"github.com/opencontainers/selinux/go-selinux", "selinuxState.setSELinuxfs"}: true,
		{"golang.org/x/crypto/cryptobyte", "Builder.AddBytes"}:                        true,
		{"golang.org/x/crypto/cryptobyte", "Builder.AddUint16LengthPrefixed"}:         true,
		{"golang.org/x/crypto/cryptobyte", "Builder.Bytes"}:                           true,
		{"golang.org/x/crypto/cryptobyte", "Builder.add"}:                             true,
		{"golang.org/x/crypto/cryptobyte", "Builder.addLengthPrefixed"}:               true,
		{"golang.org/x/crypto/cryptobyte", "Builder.callContinuation"}:                true,
		{"golang.org/x/crypto/cryptobyte", "Builder.flushChild"}:                      true,
		{"golang.org/x/crypto/cryptobyte", "NewBuilder"}:                              true,
		{"golang.org/x/crypto/cryptobyte", "String.Empty"}:                            true,
		{"golang.org/x/crypto/cryptobyte", "String.PeekASN1Tag"}:                      true,
		{"golang.org/x/crypto/cryptobyte", "String.ReadASN1"}:                         true,
		{"golang.org/x/crypto/cryptobyte", "String.ReadAnyASN1"}:                      true,
		{"golang.org/x/crypto/cryptobyte", "String.ReadBytes"}:                        true,
		{"golang.org/x/crypto/cryptobyte", "String.ReadOptionalASN1"}:                 true,
		{"golang.org/x/crypto/cryptobyte", "String.ReadUint16LengthPrefixed"}:         true,
		{"golang.org/x/crypto/cryptobyte", "String.Skip"}:                             true,
		{"golang.org/x/crypto/cryptobyte", "String.read"}:                             true,
		{"golang.org/x/crypto/cryptobyte", "String.readASN1"}:                         true,
		{"golang.org/x/crypto/cryptobyte", "String.readLengthPrefixed"}:               true,
		{"golang.org/x/crypto/cryptobyte", "String.readUnsigned"}:                     true,
		{"golang.org/x/crypto/salsa20/salsa", "XORKeyStream"}:                         true,
		{"golang.org/x/crypto/ssh", "NewClientConn"}:                                  true,
		{"golang.org/x/crypto/ssh", "NewPublicKey"}:                                   true,
		{"golang.org/x/crypto/ssh", "ed25519PublicKey.Verify"}:                        true,
		{"golang.org/x/crypto/ssh", "parseED25519"}:                                   true,
		{"golang.org/x/net/http/httpguts", "HeaderValuesContainsToken"}:               true,
		{"golang.org/x/net/http/httpguts", "headerValueContainsToken"}:                true,
		{"golang.org/x/net/http2", "Server.ServeConn"}:                                true,
		{"golang.org/x/net/http2", "serverConn.canonicalHeader"}:                      true,
		{"golang.org/x/net/http2", "serverConn.goAway"}:                               true,
		{"golang.org/x/text/encoding/unicode", "bomOverride.Transform"}:               true,
		{"golang.org/x/text/encoding/unicode", "utf16Decoder.Transform"}:              true,
	}

	if diff := cmp.Diff(want, calledVulns); diff != "" {
		log.Fatalf("reachable vulnerable symbols mismatch (-want, +got):\n%s", diff)
	}
}