Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make the reporter public #341

Merged
merged 1 commit into from
Apr 13, 2023
Merged

Make the reporter public #341

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions cmd/osv-scanner/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@ import (
"io"
"os"

"github.com/google/osv-scanner/internal/output"
"github.com/google/osv-scanner/pkg/osvscanner"
"github.com/google/osv-scanner/pkg/reporter"

"github.com/urfave/cli/v2"
)
Expand All @@ -20,10 +20,10 @@ var (
)

func run(args []string, stdout, stderr io.Writer) int {
var r *output.Reporter
var r *reporter.Reporter

cli.VersionPrinter = func(ctx *cli.Context) {
r = output.NewReporter(ctx.App.Writer, ctx.App.ErrWriter, "")
r = reporter.NewReporter(ctx.App.Writer, ctx.App.ErrWriter, "")
r.PrintText(fmt.Sprintf("osv-scanner version: %s\ncommit: %s\nbuilt at: %s\n", ctx.App.Version, commit, date))
}

Expand Down Expand Up @@ -109,7 +109,7 @@ func run(args []string, stdout, stderr io.Writer) int {
format = "json"
}

r = output.NewReporter(stdout, stderr, format)
r = reporter.NewReporter(stdout, stderr, format)

vulnResult, err := osvscanner.DoScan(osvscanner.ScannerActions{
LockfilePaths: context.StringSlice("lockfile"),
Expand All @@ -133,7 +133,7 @@ func run(args []string, stdout, stderr io.Writer) int {

if err := app.Run(args); err != nil {
if r == nil {
r = output.NewReporter(stdout, stderr, "")
r = reporter.NewReporter(stdout, stderr, "")
}
if errors.Is(err, osvscanner.VulnerabilitiesFoundErr) {
return 1
Expand Down
4 changes: 2 additions & 2 deletions internal/sourceanalysis/go.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,13 @@ import (
"path/filepath"

"github.com/google/osv-scanner/internal/govulncheckshim"
"github.com/google/osv-scanner/internal/output"
"github.com/google/osv-scanner/pkg/models"
"github.com/google/osv-scanner/pkg/reporter"
"golang.org/x/exp/slices"
"golang.org/x/vuln/exp/govulncheck"
)

func goAnalysis(r *output.Reporter, pkgs []models.PackageVulns, source models.SourceInfo) {
func goAnalysis(r *reporter.Reporter, pkgs []models.PackageVulns, source models.SourceInfo) {
vulns, vulnsByID := vulnsFromAllPkgs(pkgs)
res, err := govulncheckshim.RunGoVulnCheck(filepath.Dir(source.Path), vulns)
if err != nil {
Expand Down
4 changes: 2 additions & 2 deletions internal/sourceanalysis/sourceanalysis.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ package sourceanalysis
import (
"path/filepath"

"github.com/google/osv-scanner/internal/output"
"github.com/google/osv-scanner/pkg/models"
"github.com/google/osv-scanner/pkg/reporter"
)

// vulnsFromAllPkgs returns the flattened list of unique vulnerabilities
Expand All @@ -25,7 +25,7 @@ func vulnsFromAllPkgs(pkgs []models.PackageVulns) ([]models.Vulnerability, map[s
}

// Run runs the language specific analyzers on the code given packages and source info
func Run(r *output.Reporter, source models.SourceInfo, pkgs []models.PackageVulns) {
func Run(r *reporter.Reporter, source models.SourceInfo, pkgs []models.PackageVulns) {
// GoVulnCheck
if source.Type == "lockfile" && filepath.Base(source.Path) == "go.mod" {
goAnalysis(r, pkgs, source)
Expand Down
5 changes: 2 additions & 3 deletions pkg/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,8 @@ import (
"path/filepath"
"time"

"github.com/google/osv-scanner/internal/output"

"github.com/BurntSushi/toml"
"github.com/google/osv-scanner/pkg/reporter"
"golang.org/x/exp/slices"
)

Expand Down Expand Up @@ -64,7 +63,7 @@ func (c *ConfigManager) UseOverride(configPath string) error {
}

// Attempts to get the config
func (c *ConfigManager) Get(r *output.Reporter, targetPath string) Config {
func (c *ConfigManager) Get(r *reporter.Reporter, targetPath string) Config {
if c.OverrideConfig != nil {
return *c.OverrideConfig
}
Expand Down
20 changes: 10 additions & 10 deletions pkg/osvscanner/osvscanner.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,12 @@ import (
"path/filepath"
"strings"

"github.com/google/osv-scanner/internal/output"
"github.com/google/osv-scanner/internal/sbom"
"github.com/google/osv-scanner/pkg/config"
"github.com/google/osv-scanner/pkg/lockfile"
"github.com/google/osv-scanner/pkg/models"
"github.com/google/osv-scanner/pkg/osv"
"github.com/google/osv-scanner/pkg/reporter"

"github.com/go-git/go-billy/v5"
"github.com/go-git/go-billy/v5/osfs"
Expand Down Expand Up @@ -52,7 +52,7 @@ var OnlyUncalledVulnerabilitiesFoundErr = errors.New("only uncalled vulnerabilit
// - Any lockfiles with scanLockfile
// - Any SBOM files with scanSBOMFile
// - Any git repositories with scanGit
func scanDir(r *output.Reporter, query *osv.BatchedQuery, dir string, skipGit bool, recursive bool, useGitIgnore bool) error {
func scanDir(r *reporter.Reporter, query *osv.BatchedQuery, dir string, skipGit bool, recursive bool, useGitIgnore bool) error {
var ignoreMatcher *gitIgnoreMatcher
if useGitIgnore {
var err error
Expand Down Expand Up @@ -180,7 +180,7 @@ func (m *gitIgnoreMatcher) match(absPath string, isDir bool) (bool, error) {

// scanLockfile will load, identify, and parse the lockfile path passed in, and add the dependencies specified
// within to `query`
func scanLockfile(r *output.Reporter, query *osv.BatchedQuery, path string, parseAs string) error {
func scanLockfile(r *reporter.Reporter, query *osv.BatchedQuery, path string, parseAs string) error {
var err error
var parsedLockfile lockfile.Lockfile

Expand Down Expand Up @@ -221,7 +221,7 @@ func scanLockfile(r *output.Reporter, query *osv.BatchedQuery, path string, pars

// scanSBOMFile will load, identify, and parse the SBOM path passed in, and add the dependencies specified
// within to `query`
func scanSBOMFile(r *output.Reporter, query *osv.BatchedQuery, path string) error {
func scanSBOMFile(r *reporter.Reporter, query *osv.BatchedQuery, path string) error {
for _, provider := range sbom.Providers {
if !provider.MatchesRecognizedFileNames(path) {
// Skip if filename is not usually a sbom file of this format
Expand Down Expand Up @@ -289,7 +289,7 @@ func getCommitSHA(repoDir string) (string, error) {
}

// Scan git repository. Expects repoDir to end with /
func scanGit(r *output.Reporter, query *osv.BatchedQuery, repoDir string) error {
func scanGit(r *reporter.Reporter, query *osv.BatchedQuery, repoDir string) error {
commit, err := getCommitSHA(repoDir)
if err != nil {
return err
Expand All @@ -310,7 +310,7 @@ func scanGitCommit(query *osv.BatchedQuery, commit string, source string) error
return nil
}

func scanDebianDocker(r *output.Reporter, query *osv.BatchedQuery, dockerImageName string) error {
func scanDebianDocker(r *reporter.Reporter, query *osv.BatchedQuery, dockerImageName string) error {
cmd := exec.Command("docker", "run", "--rm", "--entrypoint", "/usr/bin/dpkg-query", dockerImageName, "-f", "${Package}###${Version}\\n", "-W")
stdout, err := cmd.StdoutPipe()

Expand Down Expand Up @@ -358,7 +358,7 @@ func scanDebianDocker(r *output.Reporter, query *osv.BatchedQuery, dockerImageNa
}

// Filters results according to config, preserving order. Returns total number of vulnerabilities removed.
func filterResults(r *output.Reporter, results *models.VulnerabilityResults, configManager *config.ConfigManager) int {
func filterResults(r *reporter.Reporter, results *models.VulnerabilityResults, configManager *config.ConfigManager) int {
removedCount := 0
newResults := []models.PackageSource{} // Want 0 vulnerabilities to show in JSON as an empty list, not null.
for _, pkgSrc := range results.Results {
Expand All @@ -384,7 +384,7 @@ func filterResults(r *output.Reporter, results *models.VulnerabilityResults, con
}

// Filters package-grouped vulnerabilities according to config, preserving ordering. Returns filtered package vulnerabilities.
func filterPackageVulns(r *output.Reporter, pkgVulns models.PackageVulns, configToUse config.Config) models.PackageVulns {
func filterPackageVulns(r *reporter.Reporter, pkgVulns models.PackageVulns, configToUse config.Config) models.PackageVulns {
ignoredVulns := map[string]struct{}{}
// Iterate over groups first to remove all aliases of ignored vulnerabilities.
var newGroups []models.GroupInfo
Expand Down Expand Up @@ -441,9 +441,9 @@ func parseLockfilePath(lockfileElem string) (string, string) {
}

// Perform osv scanner action, with optional reporter to output information
func DoScan(actions ScannerActions, r *output.Reporter) (models.VulnerabilityResults, error) {
func DoScan(actions ScannerActions, r *reporter.Reporter) (models.VulnerabilityResults, error) {
if r == nil {
r = output.NewVoidReporter()
r = reporter.NewVoidReporter()
}

configManager := config.ConfigManager{
Expand Down
4 changes: 2 additions & 2 deletions pkg/osvscanner/osvscanner_internal_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@ import (
"testing"

"github.com/google/go-cmp/cmp"
"github.com/google/osv-scanner/internal/output"
"github.com/google/osv-scanner/internal/testutility"
"github.com/google/osv-scanner/pkg/config"
"github.com/google/osv-scanner/pkg/models"
"github.com/google/osv-scanner/pkg/reporter"
)

func Test_filterResults(t *testing.T) {
Expand Down Expand Up @@ -51,7 +51,7 @@ func Test_filterResults(t *testing.T) {
tt := tt // Reinitialize for t.Parallel()
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
r := output.NewVoidReporter()
r := reporter.NewVoidReporter()
// ConfigManager looks for osv-scanner.toml in the source path.
// Sources in the test input should point to files/folders in the text fixture folder for this to work correctly.
configManager := config.ConfigManager{
Expand Down
4 changes: 2 additions & 2 deletions pkg/osvscanner/vulnerability_result.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,16 +4,16 @@ import (
"fmt"
"sort"

"github.com/google/osv-scanner/internal/output"
"github.com/google/osv-scanner/internal/sourceanalysis"
"github.com/google/osv-scanner/pkg/grouper"
"github.com/google/osv-scanner/pkg/models"
"github.com/google/osv-scanner/pkg/osv"
"github.com/google/osv-scanner/pkg/reporter"
)

// groupResponseBySource converts raw OSV API response into structured vulnerability information
// grouped by source location.
func groupResponseBySource(r *output.Reporter, query osv.BatchedQuery, resp *osv.HydratedBatchedResponse, callAnalysis bool) models.VulnerabilityResults {
func groupResponseBySource(r *reporter.Reporter, query osv.BatchedQuery, resp *osv.HydratedBatchedResponse, callAnalysis bool) models.VulnerabilityResults {
output := models.VulnerabilityResults{
Results: []models.PackageSource{},
}
Expand Down
4 changes: 2 additions & 2 deletions pkg/osvscanner/vulnerability_result_internal_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,15 @@ import (
"reflect"
"testing"

"github.com/google/osv-scanner/internal/output"
"github.com/google/osv-scanner/pkg/models"
"github.com/google/osv-scanner/pkg/osv"
"github.com/google/osv-scanner/pkg/reporter"
)

func Test_groupResponseBySource(t *testing.T) {
t.Parallel()
type args struct {
r *output.Reporter
r *reporter.Reporter
query osv.BatchedQuery
resp *osv.HydratedBatchedResponse
callAnalysis bool
Expand Down
9 changes: 5 additions & 4 deletions internal/output/reporter.go → pkg/reporter/reporter.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
package output
package reporter

import (
"fmt"
"io"
"strings"

"github.com/google/osv-scanner/internal/output"
"github.com/google/osv-scanner/pkg/models"
)

Expand Down Expand Up @@ -60,11 +61,11 @@ func (r *Reporter) PrintText(msg string) {
func (r *Reporter) PrintResult(vulnResult *models.VulnerabilityResults) error {
switch r.format {
case "json":
return PrintJSONResults(vulnResult, r.stdout)
return output.PrintJSONResults(vulnResult, r.stdout)
case "markdown":
PrintMarkdownTableResults(vulnResult, r.stdout)
output.PrintMarkdownTableResults(vulnResult, r.stdout)
case "table":
PrintTableResults(vulnResult, r.stdout)
output.PrintTableResults(vulnResult, r.stdout)
}
Comment on lines 61 to 69
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit:
Since it's public, I think it'd make sense to make Reporter an interface, with individual json/markdown/table/void reporter implementations.

That way, an external program could write/wrap their own logging/formatting outputs.

(Also, it avoids this awkward format checking)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This sounds like a interesting idea, I'll make the changes and push it in a separate PR.


return nil
Expand Down