internal/idstr/ids.go

// Copyright 2024 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// Package idstr provides utilities for working with vulnerability
// identifier strings.
package idstr

import "regexp"

const ghsaStr = `GHSA-[^-]{4}-[^-]{4}-[^-]{4}`

var (
	ghsaRE, ghsaStrict = re(ghsaStr)
)

func IsGHSA(s string) bool {
	return ghsaStrict.MatchString(s)
}

func FindGHSA(s string) string {
	return ghsaRE.FindString(s)
}

const cveStr = `CVE-\d{4}-\d{4,}`

var (
	cveRE, cveStrict = re(cveStr)
)

func IsCVE(s string) bool {
	return cveStrict.MatchString(s)
}

func FindCVE(s string) string {
	return cveRE.FindString(s)
}

const goIDStr = `GO-\d{4}-\d{4,}`

var (
	goRE, goIDStrict = re(goIDStr)
)

func IsGoID(s string) bool {
	return goIDStrict.MatchString(s)
}

func findGoID(s string) string {
	return goRE.FindString(s)
}

func re(s string) (*regexp.Regexp, *regexp.Regexp) {
	return regexp.MustCompile(s), regexp.MustCompile(`^` + s + `$`)
}

// IsIdentifier returns whether the given ID is a recognized identifier
// (currently, either a GHSA, CVE, or Go ID).
func IsIdentifier(id string) bool {
	return IsAliasType(id) || IsGoID(id)
}

func FindID(s string) string {
	if cve := FindCVE(s); cve != "" {
		return cve
	}
	if ghsa := FindGHSA(s); ghsa != "" {
		return ghsa
	}
	if gid := findGoID(s); gid != "" {
		return gid
	}
	return ""
}

// IsAliasType returns whether the given ID is a recognized alias type
// (currently, either a GHSA or CVE).
func IsAliasType(id string) bool {
	return IsGHSA(id) || IsCVE(id)
}