src

Go monorepo.
git clone git://code.dwrz.net/src
Log | Files | Refs

source.go (1550B)

      1 // Copyright 2022 The Go Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style
      3 // license that can be found in the LICENSE file.
      4 
      5 package scan
      6 
      7 import (
      8 	"context"
      9 	"fmt"
     10 
     11 	"golang.org/x/tools/go/packages"
     12 	"golang.org/x/vuln/internal/client"
     13 	"golang.org/x/vuln/internal/derrors"
     14 	"golang.org/x/vuln/internal/govulncheck"
     15 	"golang.org/x/vuln/internal/vulncheck"
     16 )
     17 
     18 // runSource reports vulnerabilities that affect the analyzed packages.
     19 //
     20 // Vulnerabilities can be called (affecting the package, because a vulnerable
     21 // symbol is actually exercised) or just imported by the package
     22 // (likely having a non-affecting outcome).
     23 func runSource(ctx context.Context, handler govulncheck.Handler, cfg *config, client *client.Client, dir string) (err error) {
     24 	defer derrors.Wrap(&err, "govulncheck")
     25 
     26 	if cfg.ScanLevel.WantPackages() && len(cfg.patterns) == 0 {
     27 		return errNoPatterns
     28 	}
     29 	if !gomodExists(dir) {
     30 		return errNoGoMod
     31 	}
     32 	graph := vulncheck.NewPackageGraph(cfg.GoVersion)
     33 	pkgConfig := &packages.Config{
     34 		Dir:   dir,
     35 		Tests: cfg.test,
     36 		Env:   cfg.env,
     37 	}
     38 	if err := graph.LoadPackagesAndMods(pkgConfig, cfg.tags, cfg.patterns, cfg.ScanLevel == govulncheck.ScanLevelSymbol); err != nil {
     39 		if isGoVersionMismatchError(err) {
     40 			return fmt.Errorf("%v\n\n%v", errGoVersionMismatch, err)
     41 		}
     42 		return fmt.Errorf("loading packages: %w", err)
     43 	}
     44 
     45 	if cfg.ScanLevel.WantPackages() && len(graph.TopPkgs()) == 0 {
     46 		return errNoPackagesMatched
     47 	}
     48 	return vulncheck.Source(ctx, handler, &cfg.Config, client, graph)
     49 }