src

Go monorepo.
git clone git://code.dwrz.net/src
Log | Files | Refs

fixed.go (1024B)

      1 // Copyright 2023 The Go Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style
      3 // license that can be found in the LICENSE file.
      4 
      5 package semver
      6 
      7 import "golang.org/x/vuln/internal/osv"
      8 
      9 // NonSupersededFix returns a fixed version from ranges
     10 // that is not superseded by any other fix or any other
     11 // introduction of a vulnerability. Returns "" in case
     12 // there is no such fixed version.
     13 func NonSupersededFix(ranges []osv.Range) string {
     14 	var latestFixed string
     15 	for _, r := range ranges {
     16 		if r.Type == "SEMVER" {
     17 			for _, e := range r.Events {
     18 				fixed := e.Fixed
     19 				if fixed != "" && Less(latestFixed, fixed) {
     20 					latestFixed = fixed
     21 				}
     22 			}
     23 
     24 			// If the vulnerability was re-introduced after the latest fix
     25 			// we found, there is no latest fix for this range.
     26 			for _, e := range r.Events {
     27 				introduced := e.Introduced
     28 				if introduced != "" && introduced != "0" && Less(latestFixed, introduced) {
     29 					latestFixed = ""
     30 					break
     31 				}
     32 			}
     33 		}
     34 	}
     35 	return latestFixed
     36 }