src

Go monorepo.
git clone git://code.dwrz.net/src
Log | Files | Refs

doc.go (2089B)

      1 // Copyright 2022 The Go Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style
      3 // license that can be found in the LICENSE file.
      4 
      5 /*
      6 Package vulncheck detects uses of known vulnerabilities
      7 in Go programs.
      8 
      9 Vulncheck identifies vulnerability uses in Go programs
     10 at the level of call graph, package import graph, and module
     11 requires graph. For instance, vulncheck identifies which
     12 vulnerable functions and methods are transitively called
     13 from the program entry points. vulncheck also detects
     14 transitively imported packages and required modules that
     15 contain known vulnerable functions and methods.
     16 
     17 We recommend using the command line tool [govulncheck] to
     18 detect vulnerabilities in your code.
     19 
     20 # Usage
     21 
     22 The two main APIs of vulncheck, [Source] and [Binary], allow vulnerability
     23 detection in Go source code and binaries, respectively.
     24 
     25 [Source] accepts a list of [Package] objects, which
     26 are a trimmed version of [golang.org/x/tools/go/packages.Package] objects to
     27 reduce memory consumption. [Binary] accepts a path to a Go binary file.
     28 
     29 Both [Source] and [Binary] require information about known
     30 vulnerabilities in the form of a vulnerability database,
     31 specifically a [golang.org/x/vuln/internal/client.Client].
     32 The vulnerabilities
     33 are modeled using the [golang.org/x/vuln/internal/osv] format.
     34 
     35 # Results
     36 
     37 The results of vulncheck are slices of the call graph, package imports graph,
     38 and module requires graph leading to the use of an identified vulnerability.
     39 The parts of these graphs not related to any vulnerabilities are omitted.
     40 
     41 The [CallStacks] and [ImportChains] functions search the returned slices for
     42 user-friendly representative call stacks and import chains. These call stacks
     43 and import chains are provided as examples of vulnerability uses in the client
     44 code.
     45 
     46 # Limitations
     47 
     48 There are some limitations with vulncheck. Please see the
     49 [documented limitations] for more information.
     50 
     51 [govulncheck]: https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
     52 [documented limitations]: https://go.dev/security/vulncheck#limitations.
     53 */
     54 package vulncheck