diff --git a/internal/vuln/vulns.go b/internal/vuln/vulns.go index 2ced6714c..445b2e6da 100644 --- a/internal/vuln/vulns.go +++ b/internal/vuln/vulns.go @@ -78,9 +78,10 @@ func toVulns(entries []*osv.Entry) []Vuln { type AffectedPackage struct { PackagePath string Versions string - // List of exported affected symbols. Empty list - // implies all symbols in the package are affected. - Symbols []string + // Lists of affected symbols. + // If both of these lists are empty, all symbols in the package are affected. + ExportedSymbols []string + UnexportedSymbols []string } // A pair is like an osv.Range, but each pair is a self-contained 2-tuple @@ -152,10 +153,12 @@ func AffectedPackages(e *osv.Entry) []*AffectedPackage { vs = append(vs, s) } for _, p := range a.EcosystemSpecific.Packages { + exported, unexported := affectedSymbols(p.Symbols) affs = append(affs, &AffectedPackage{ - PackagePath: p.Path, - Versions: strings.Join(vs, ", "), - Symbols: exportedSymbols(p.Symbols), + PackagePath: p.Path, + Versions: strings.Join(vs, ", "), + ExportedSymbols: exported, + UnexportedSymbols: unexported, // TODO(hyangah): where to place GOOS/GOARCH info }) } @@ -163,18 +166,19 @@ func AffectedPackages(e *osv.Entry) []*AffectedPackage { return affs } -func exportedSymbols(in []string) []string { - var out []string +func affectedSymbols(in []string) (e, u []string) { for _, s := range in { exported := true for _, part := range strings.Split(s, ".") { if !token.IsExported(part) { - exported = false // exported only all parts in the symbol name are exported. + exported = false // exported only if all parts of the symbol name are exported. } } if exported { - out = append(out, s) + e = append(e, s) + } else { + u = append(u, s) } } - return out + return e, u } diff --git a/internal/vuln/vulns_test.go b/internal/vuln/vulns_test.go index 3fd99fa4c..167a8cc1d 100644 --- a/internal/vuln/vulns_test.go +++ b/internal/vuln/vulns_test.go @@ -261,8 +261,8 @@ func TestAffectedPackagesPackagesSymbols(t *testing.T) { }}, }, want: []*AffectedPackage{{ - PackagePath: "example.com/mod/pkg", - Symbols: []string{"F"}, + PackagePath: "example.com/mod/pkg", + ExportedSymbols: []string{"F"}, }}, }, { @@ -280,8 +280,9 @@ func TestAffectedPackagesPackagesSymbols(t *testing.T) { }}, }, want: []*AffectedPackage{{ - PackagePath: "example.com/mod/pkg", - Symbols: []string{"F", "S.F"}, // unexported symbols are excluded. + PackagePath: "example.com/mod/pkg", + ExportedSymbols: []string{"F", "S.F"}, + UnexportedSymbols: []string{"g", "S.f", "s.F", "s.f"}, }}, }, { @@ -328,11 +329,12 @@ func TestAffectedPackagesPackagesSymbols(t *testing.T) { want: []*AffectedPackage{{ PackagePath: "example.com/mod1/pkg1", }, { - PackagePath: "example.com/mod1/pkg2", - Symbols: []string{"F"}, + PackagePath: "example.com/mod1/pkg2", + ExportedSymbols: []string{"F"}, }, { - PackagePath: "example.com/mod2/pkg3", - Symbols: []string{"H"}, + PackagePath: "example.com/mod2/pkg3", + ExportedSymbols: []string{"H"}, + UnexportedSymbols: []string{"g"}, }}, }, } diff --git a/static/frontend/vuln/entry/entry.tmpl b/static/frontend/vuln/entry/entry.tmpl index 44b935df3..620aa8aba 100644 --- a/static/frontend/vuln/entry/entry.tmpl +++ b/static/frontend/vuln/entry/entry.tmpl @@ -56,12 +56,20 @@
{{.PackagePath}}
{{if .Versions}}{{.Versions}}{{else}}all versions, no known fixed{{end}}
- {{if .Symbols}}{{ $length := len .Symbols}} - {{ $vuln := . }} - {{if lt $length 5}} - {{else}}
{{len .Symbols}} affected symbols -
+ {{ $vuln := . }} + {{if .ExportedSymbols}}{{ $length := len .ExportedSymbols}} + {{if lt $length 5}} + {{else}}
{{len .ExportedSymbols}} affected symbols +
{{end}} + {{else if .UnexportedSymbols}} +
{{len .UnexportedSymbols}} unexported affected symbols + +
{{else}}all symbols{{end}}
@@ -109,4 +117,4 @@ Suggest an edit to this report. -{{end}} \ No newline at end of file +{{end}}