Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/pkgsite: reports vulnerabilities incorrectly for default branch #57327

Closed
codyoss opened this issue Dec 15, 2022 · 4 comments
Closed

x/pkgsite: reports vulnerabilities incorrectly for default branch #57327

codyoss opened this issue Dec 15, 2022 · 4 comments
Assignees
@jamalc
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. pkgsite vulncheck or vulndb Issues for the x/vuln or x/vulndb repo
Milestone
pkgsite/backlog

Comments

@codyoss
Copy link
Member

codyoss commented Dec 15, 2022

What is the URL of the page with the issue?

https://pkg.go.dev/net/http@master

Screenshot

Screenshot 2022-12-15 at 9 09 45 AM

What did you do?

Go to the link above

What did you expect to see?

Not so many vulnerabilities reported. I believe that most(all?) of these are actually fixed on HEAD. Maybe vulns should only be reported on released versions?

What did you see instead?

A lot of vulnerabilities listed.
@gopherbot gopherbot added this to the Unreleased milestone Dec 15, 2022
@codyoss
Copy link
Member Author

codyoss commented Dec 15, 2022

Some of these are maybe valid and just have not had a release yet, I am not sure. But there are for sure some really old ones listed too, example: https://pkg.go.dev/vuln/GO-2022-0761

@findleyr
Copy link
Contributor

CC @julieqiu @jamalc

@findleyr findleyr added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Dec 15, 2022
@hyangah hyangah added the vulncheck or vulndb Issues for the x/vuln or x/vulndb repo label Dec 15, 2022
@findleyr findleyr modified the milestones: Unreleased, pkgsite/later Dec 16, 2022
@jamalc
Copy link

jamalc commented Jan 5, 2023

I think the solution here is to not show vuln information on stdlib pages at master. These vulns show up because the tag master translates to a psuedoversion (e.g., v0.0.0-20230104211531-bae7d772e800) which is within the vulnerable range according to golang.org/x/vuln/osv.Affects.AffectsSemver.

cc @golang/security

@gopherbot
Copy link

Change https://go.dev/cl/460817 mentions this issue: internal/vulns: disable display of vulns for stdlib pages at master

@golang golang locked and limited conversation to collaborators Jan 9, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@jamalc jamalc

Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. pkgsite vulncheck or vulndb Issues for the x/vuln or x/vulndb repo
Projects
None yet
Milestone
pkgsite/backlog
Development

No branches or pull requests
5 participants
@hyangah @codyoss @gopherbot @jamalc @findleyr