From 8e58b0520af6eae3a7a5cb65efaeec0a6eb2be6a Mon Sep 17 00:00:00 2001 From: Pohan Huang Date: Thu, 16 Jul 2026 01:43:49 +0800 Subject: [PATCH] fix: remove deprecate way of implmentaion - ioutils - Sprintf - replac(.., -1) Signed-off-by: pohanhuang --- common/debug.go | 3 +- share/set.go | 2 +- share/tar.go | 19 +++++----- share/utils.go | 3 +- updater/fetchers/alpine/alpine.go | 38 +++++++++++-------- updater/fetchers/alpine/alpine_test.go | 7 +--- updater/fetchers/amazon/amazon.go | 9 +++-- updater/fetchers/apps/apps.go | 3 +- updater/fetchers/apps/cvedetails.go | 8 ++-- updater/fetchers/apps/ghsa.go | 8 ++-- updater/fetchers/apps/govuln.go | 2 +- updater/fetchers/apps/k8s.go | 6 +-- updater/fetchers/apps/manual.go | 4 +- updater/fetchers/apps/nginx.go | 16 ++++---- updater/fetchers/apps/openssl.go | 4 +- updater/fetchers/apps/ruby.go | 13 +++---- updater/fetchers/chainguardv2/chainguardv2.go | 7 ++-- updater/fetchers/debian/debian.go | 4 +- updater/fetchers/mariner/mariner.go | 9 +++-- updater/fetchers/oracle/oracle.go | 8 ++-- updater/fetchers/photon/photon.go | 6 +-- updater/fetchers/rhel2/rhel.go | 37 +++++++++--------- updater/fetchers/rocky/rocky.go | 8 ++-- updater/fetchers/suse/suse.go | 10 ++--- updater/fetchers/ubuntu/ubuntu.go | 11 +++--- updater/nvd/xml.go | 3 +- 26 files changed, 124 insertions(+), 124 deletions(-) diff --git a/common/debug.go b/common/debug.go index d0584b0..9ac59d9 100644 --- a/common/debug.go +++ b/common/debug.go @@ -1,7 +1,6 @@ package common import ( - "fmt" "strings" "time" @@ -11,7 +10,7 @@ import ( func firstN(s string, n int) string { if len(s) > n { - return fmt.Sprintf("%s...", s[:n]) + return s[:n] + "..." } return s } diff --git a/share/set.go b/share/set.go index dc23b50..d526e18 100644 --- a/share/set.go +++ b/share/set.go @@ -314,7 +314,7 @@ func (set *threadUnsafeSet) String() string { for elem := range *set { items = append(items, fmt.Sprintf("%v", elem)) } - return fmt.Sprintf("{%s}", strings.Join(items, ", ")) + return "{" + strings.Join(items, ", ") + "}" } func (pair orderedPair) String() string { diff --git a/share/tar.go b/share/tar.go index ad3ea8d..aaaee0f 100644 --- a/share/tar.go +++ b/share/tar.go @@ -25,7 +25,6 @@ import ( "errors" "fmt" "io" - "io/ioutil" "os" "os/exec" "path/filepath" @@ -119,7 +118,7 @@ func SelectivelyExtractArchive(r io.Reader, selected func(string) bool, maxFileS log.WithFields(log.Fields{"size": size, "filename": filename}).Error("file too big") return nil } - d, _ := ioutil.ReadAll(reader) + d, _ := io.ReadAll(reader) data[filename] = d return nil } @@ -142,7 +141,7 @@ func SelectivelyExtractToFiles(r io.Reader, dir string, selected func(string) bo log.WithFields(log.Fields{"size": size, "filename": filename}).Error("file too big") return nil } - tmpfile, err := ioutil.TempFile(dir, "extract") + tmpfile, err := os.CreateTemp(dir, "extract") if err != nil { log.WithFields(log.Fields{"err": err, "filename": filename}).Error("write to temp file fail") return nil @@ -203,13 +202,13 @@ func ExtractAllArchiveToFiles(path string, r io.Reader, maxFileSize int64, encry // Extract the element if hdr.Typeflag == tar.TypeReg { - data, _ := ioutil.ReadAll(tr) + data, _ := io.ReadAll(tr) if encryptKey != nil { data, _ = Encrypt(encryptKey, data) } - err = ioutil.WriteFile(path+filename, data, 0400) + err = os.WriteFile(path+filename, data, 0400) if err != nil { return err } @@ -330,7 +329,7 @@ func getTarReader(r io.Reader) (*TarReadCloser, error) { } return &TarReadCloser{tar.NewReader(gr), gr}, nil case bytes.HasPrefix(header, bzip2Header): - bzip2r := ioutil.NopCloser(bzip2.NewReader(br)) + bzip2r := io.NopCloser(bzip2.NewReader(br)) return &TarReadCloser{tar.NewReader(bzip2r), bzip2r}, nil case bytes.HasPrefix(header, xzHeader): xzr, err := NewXzReader(br) @@ -341,7 +340,7 @@ func getTarReader(r io.Reader) (*TarReadCloser, error) { } } - dr := ioutil.NopCloser(br) + dr := io.NopCloser(br) return &TarReadCloser{tar.NewReader(dr), dr}, nil } @@ -401,7 +400,7 @@ func SelectivelyExtractModules(r io.Reader, lastfix string, maxFileSize int64) ( // Extract the element if hdr.Typeflag == tar.TypeReg { - d, _ := ioutil.ReadAll(tr) + d, _ := io.ReadAll(tr) data[filename] = d } } @@ -409,12 +408,12 @@ func SelectivelyExtractModules(r io.Reader, lastfix string, maxFileSize int64) ( return data, nil } -//func SelectivelyExtractToFile(r io.Reader, prefix string, toExtract []string, dir string) (map[string]string, error) { +// func SelectivelyExtractToFile(r io.Reader, prefix string, toExtract []string, dir string) (map[string]string, error) { func SelectivelyExtractToFile(r io.Reader, selected func(string) bool, dir string) (map[string]string, error) { files := make(map[string]string) extract := func(filename string, size int64, reader io.ReadCloser) error { - fpath := dir + "/" + strings.Replace(filename, "/", "_", -1) + fpath := dir + "/" + strings.ReplaceAll(filename, "/", "_") f, err := os.Create(fpath) if err != nil { return ErrCouldNotWriteToDisk diff --git a/share/utils.go b/share/utils.go index 436453a..e29b67f 100644 --- a/share/utils.go +++ b/share/utils.go @@ -8,7 +8,6 @@ import ( "crypto/rand" "fmt" "io" - "io/ioutil" "os/exec" "runtime" "sort" @@ -48,7 +47,7 @@ func GunzipBytes(buf []byte) []byte { return nil } defer r.Close() - uzb, _ := ioutil.ReadAll(r) + uzb, _ := io.ReadAll(r) return uzb } diff --git a/updater/fetchers/alpine/alpine.go b/updater/fetchers/alpine/alpine.go index b745012..70bf8a7 100644 --- a/updater/fetchers/alpine/alpine.go +++ b/updater/fetchers/alpine/alpine.go @@ -2,8 +2,7 @@ package alpine import ( "encoding/json" - "fmt" - "io/ioutil" + "io" "net/http" "os" "regexp" @@ -22,11 +21,13 @@ const ( updaterFlag = "alpine-secdbUpdater" cveURLPrefix = "https://cve.mitre.org/cgi-bin/cvename.cgi?name=" ) + const ( aportsGitURL = "git://git.alpinelinux.org/aports" ) var cveRegex = regexp.MustCompile(`^CVE-\d{4}-\d{4,}$`) +var nsRegexp = regexp.MustCompile(`(.*)/.*-`) type AlpineFetcher struct { repositoryLocalPath string @@ -134,10 +135,14 @@ func (u *AlpineFetcher) downloadSecDB(url string) ([]common.Vulnerability, error log.WithError(err).WithFields(log.Fields{"url": url}).Error("Failed to download alpine db") return nil, err } - - body, _ := ioutil.ReadAll(r.Body) defer r.Body.Close() + body, err := io.ReadAll(r.Body) + if err != nil { + log.WithError(err).WithFields(log.Fields{"url": url}).Error("Failed to read alpine db response") + return nil, err + } + return parseSecDB(body, url) } @@ -147,17 +152,20 @@ func (u *AlpineFetcher) downloadSecDBNamespaces() ([]string, error) { log.WithError(err).WithFields(log.Fields{"url": secdbURL}).Error("Failed to download alpine db") return nil, err } - defer r.Body.Close() - body, _ := ioutil.ReadAll(r.Body) - nss := make([]string, 0) + body, err := io.ReadAll(r.Body) + if err != nil { + log.WithError(err).WithFields(log.Fields{"url": secdbURL}).Error("Failed to read alpine db response") + return nil, err + } - // locate folder from the list - var nsRegexp = regexp.MustCompile(`(.*)/.*-`) - matches := nsRegexp.FindAllStringSubmatch(string(body[:]), -1) + nss := make([]string, 0) + matches := nsRegexp.FindAllSubmatch(body, -1) for _, m := range matches { - nss = append(nss, m[1]) + if len(m) == 2 && len(m[1]) > 0 { + nss = append(nss, string(m[1])) + } } return nss, nil @@ -171,10 +179,10 @@ func (u *AlpineFetcher) FetchUpdate() (resp updater.FetcherResponse, err error) for _, ns := range nss { log.WithFields(log.Fields{"namespace": ns}).Debug() - if vulns, err := u.downloadSecDB(fmt.Sprintf("%s/%s/main.json", secdbURL, ns)); err == nil { + if vulns, err := u.downloadSecDB(secdbURL + "/" + ns + "/main.json"); err == nil { resp.Vulnerabilities = append(resp.Vulnerabilities, vulns...) } - if vulns, err := u.downloadSecDB(fmt.Sprintf("%s/%s/community.json", secdbURL, ns)); err == nil { + if vulns, err := u.downloadSecDB(secdbURL + "/" + ns + "/community.json"); err == nil { resp.Vulnerabilities = append(resp.Vulnerabilities, vulns...) } } @@ -182,7 +190,7 @@ func (u *AlpineFetcher) FetchUpdate() (resp updater.FetcherResponse, err error) vulsMap := make(map[string]common.Vulnerability) for _, vul := range resp.Vulnerabilities { - key := fmt.Sprintf("%s:%s", vul.FixedIn[0].Feature.Namespace, vul.Name) + key := vul.FixedIn[0].Feature.Namespace + ":" + vul.Name vulsMap[key] = vul } @@ -190,7 +198,7 @@ func (u *AlpineFetcher) FetchUpdate() (resp updater.FetcherResponse, err error) /* if vuls, err := u.fromAports(); err == nil { for _, vul := range vuls { - key := fmt.Sprintf("%s:%s", vul.FixedIn[0].Feature.Namespace, vul.Name) + key := vul.FixedIn[0].Feature.Namespace + ":" + vul.Name if _, ok := vulsMap[key]; !ok { correctVulRecord(&vul) resp.Vulnerabilities = append(resp.Vulnerabilities, vul) diff --git a/updater/fetchers/alpine/alpine_test.go b/updater/fetchers/alpine/alpine_test.go index 497acc6..0a2c5d2 100644 --- a/updater/fetchers/alpine/alpine_test.go +++ b/updater/fetchers/alpine/alpine_test.go @@ -1,10 +1,8 @@ package alpine import ( + "os" "testing" - - "io/ioutil" - "regexp" ) func TestParseSecDbIndex(t *testing.T) { @@ -27,7 +25,6 @@ func TestParseSecDbIndex(t *testing.T) {
` - var nsRegexp = regexp.MustCompile(`(.*)/.*-`) matches := nsRegexp.FindAllStringSubmatch(index, -1) var count int @@ -43,7 +40,7 @@ func TestParseSecDbIndex(t *testing.T) { func TestParseSecDb(t *testing.T) { filename := "secdb36main" - body, _ := ioutil.ReadFile(filename) + body, _ := os.ReadFile(filename) if _, err := parseSecDB(body, filename); err != nil { t.Errorf("Unmarshal error: %v", err) diff --git a/updater/fetchers/amazon/amazon.go b/updater/fetchers/amazon/amazon.go index d8f7050..502914b 100644 --- a/updater/fetchers/amazon/amazon.go +++ b/updater/fetchers/amazon/amazon.go @@ -4,10 +4,11 @@ import ( "compress/gzip" "encoding/xml" "fmt" - "io/ioutil" + "io" "net/http" "os" "regexp" + "strconv" "strings" "time" @@ -69,7 +70,7 @@ func (net netMethod) DownloadHTMLPage(url string) (string, string, error) { } defer r.Body.Close() - body, _ := ioutil.ReadAll(r.Body) + body, _ := io.ReadAll(r.Body) plain := html2text.HTML2Text(string(body)) return string(body), plain, nil } @@ -106,7 +107,7 @@ func (u *AmazonFetcher) fetchOvalFeed(o *ovalInfo, net updater.NetInterface) ([] vulns := make([]common.Vulnerability, 0) - fullname := fmt.Sprintf("%s%s", common.CVESourceRoot, o.filename) + fullname := common.CVESourceRoot + o.filename file, err := os.Open(fullname) if err != nil { log.WithFields(log.Fields{"file": o.filename}).Error("Failed to open the feed file") @@ -191,7 +192,7 @@ func (u *AmazonFetcher) fetchOvalFeed(o *ovalInfo, net updater.NetInterface) ([] } featureVersion := common.FeatureVersion{ Feature: common.Feature{ - Namespace: fmt.Sprintf("amzn:%d", o.version), + Namespace: "amzn:" + strconv.Itoa(o.version), Name: pkg, }, Version: ver, diff --git a/updater/fetchers/apps/apps.go b/updater/fetchers/apps/apps.go index e3c798d..5d68a02 100644 --- a/updater/fetchers/apps/apps.go +++ b/updater/fetchers/apps/apps.go @@ -3,7 +3,6 @@ package apps import ( "bufio" "encoding/json" - "fmt" "os" "strings" @@ -30,7 +29,7 @@ func init() { } func addAppVulMap(mv *common.AppModuleVul) { - key := fmt.Sprintf("%s:%s", mv.ModuleName, mv.VulName) + key := mv.ModuleName + ":" + mv.VulName vulMap[key] = mv } diff --git a/updater/fetchers/apps/cvedetails.go b/updater/fetchers/apps/cvedetails.go index 1c3884e..7c7f905 100644 --- a/updater/fetchers/apps/cvedetails.go +++ b/updater/fetchers/apps/cvedetails.go @@ -3,7 +3,7 @@ package apps import ( "bufio" "fmt" - "io/ioutil" + "io" "net/http" "regexp" "strconv" @@ -81,7 +81,7 @@ func readCVEDetailsPage(url, product, module string) error { return err } defer r.Body.Close() - body, _ := ioutil.ReadAll(r.Body) + body, _ := io.ReadAll(r.Body) scanner := bufio.NewScanner(strings.NewReader(string(body))) for scanner.Scan() { @@ -123,7 +123,7 @@ func getCveDetail(cveurl, cve, product, module string) (*common.AppModuleVul, er return nil, err } - body, _ := ioutil.ReadAll(r.Body) + body, _ := io.ReadAll(r.Body) defer r.Body.Close() scanner := bufio.NewScanner(strings.NewReader(string(body))) @@ -164,7 +164,7 @@ func getCveDetail(cveurl, cve, product, module string) (*common.AppModuleVul, er if gettingFfixedVer { if affectedStatus == 7 { //product - if strings.Contains(line, fmt.Sprintf(">%s", product)) { + if strings.Contains(line, ">"+product+"") { productMatch = true } else { productMatch = false diff --git a/updater/fetchers/apps/ghsa.go b/updater/fetchers/apps/ghsa.go index f6f67b5..760c240 100644 --- a/updater/fetchers/apps/ghsa.go +++ b/updater/fetchers/apps/ghsa.go @@ -79,7 +79,7 @@ func cleanupVersion(version string) string { } func loadGHSAData(ghsaFile, app, prefix string, lowercase bool) error { - dataFile := fmt.Sprintf("%s%s", common.CVESourceRoot, ghsaFile) + dataFile := common.CVESourceRoot + ghsaFile f, err := os.Open(dataFile) if err != nil { log.WithFields(log.Fields{"file": dataFile}).Error("Cannot find local database") @@ -126,18 +126,18 @@ func loadGHSAData(ghsaFile, app, prefix string, lowercase bool) error { vulName = r.Advisory.GHSAID } - moduleName := fmt.Sprintf("%s%s", prefix, r.Package.Name) + moduleName := prefix + r.Package.Name if lowercase { moduleName = strings.ToLower(moduleName) } affectedVer := getVersion(cleanupVersion(r.AffectedVersion)) fixedVer := getVersion(cleanupVersion(r.PatchedVersion.Identifier)) - key := fmt.Sprintf("%s-%s", vulName, moduleName) + key := vulName + "-" + moduleName if v, ok := vmap[key]; !ok { v = &common.AppModuleVul{ VulName: vulName, - Description: fmt.Sprintf("%s\n%s\n", r.Advisory.Summary, r.Advisory.Description), + Description: r.Advisory.Summary + "\n" + r.Advisory.Description + "\n", AffectedVer: affectedVer, FixedVer: fixedVer, AppName: app, diff --git a/updater/fetchers/apps/govuln.go b/updater/fetchers/apps/govuln.go index dc57cde..0495552 100644 --- a/updater/fetchers/apps/govuln.go +++ b/updater/fetchers/apps/govuln.go @@ -439,7 +439,7 @@ func loadGoOSVVulnerabilities() (map[string]*common.AppModuleVul, utils.Set, err goVulnMap := make(map[string]*common.AppModuleVul) cvesIncludeGoVuln := utils.NewSet() - dataFile := fmt.Sprintf("%s%s", common.CVESourceRoot, goVulnDBPath) + dataFile := common.CVESourceRoot + goVulnDBPath zipReader, err := zip.OpenReader(dataFile) if err != nil { log.WithFields(log.Fields{"error": err}).Error("Failed to open Go OSV zip file") diff --git a/updater/fetchers/apps/k8s.go b/updater/fetchers/apps/k8s.go index 8632aa7..03bbcee 100644 --- a/updater/fetchers/apps/k8s.go +++ b/updater/fetchers/apps/k8s.go @@ -4,7 +4,7 @@ import ( "compress/gzip" "encoding/json" "fmt" - "io/ioutil" + "io" "os" log "github.com/sirupsen/logrus" @@ -32,7 +32,7 @@ type k8sData struct { func k8sUpdate() error { log.Info("fetching kubernetes vulnerabilities") - dataFile := fmt.Sprintf("%s%s", common.CVESourceRoot, k8sDataFile) + dataFile := common.CVESourceRoot + k8sDataFile f, err := os.Open(dataFile) if err != nil { log.WithFields(log.Fields{"file": dataFile}).Error("Cannot find local database") @@ -48,7 +48,7 @@ func k8sUpdate() error { } defer gzr.Close() - byteValue, _ := ioutil.ReadAll(gzr) + byteValue, _ := io.ReadAll(gzr) var data k8sData if err = json.Unmarshal(byteValue, &data); err != nil { diff --git a/updater/fetchers/apps/manual.go b/updater/fetchers/apps/manual.go index ef436c5..552176d 100644 --- a/updater/fetchers/apps/manual.go +++ b/updater/fetchers/apps/manual.go @@ -43,8 +43,8 @@ func manualUpdate() error { var cveCount int for _, fn := range []string{ - fmt.Sprintf("%s%s%s", common.CVESourceRoot, appManualFolder, "busybox.db"), - fmt.Sprintf("%s%s%s", common.CVESourceRoot, appManualFolder, "toomcat.db"), + common.CVESourceRoot + appManualFolder + "busybox.db", + common.CVESourceRoot + appManualFolder + "toomcat.db", } { file, err := os.Open(fn) if err != nil { diff --git a/updater/fetchers/apps/nginx.go b/updater/fetchers/apps/nginx.go index b2ddc7b..cf8b360 100644 --- a/updater/fetchers/apps/nginx.go +++ b/updater/fetchers/apps/nginx.go @@ -2,7 +2,7 @@ package apps import ( "fmt" - "io/ioutil" + "io" "net/http" "regexp" "strings" @@ -36,7 +36,7 @@ func nginxUpdate() error { } // Get the list of nginx that we have to process. defer r.Body.Close() - body, _ := ioutil.ReadAll(r.Body) + body, _ := io.ReadAll(r.Body) cves := strings.Split(string(body), "

") var name, affectedVer, fixedVer string @@ -75,9 +75,9 @@ func nginxUpdate() error { match = severityRegexp.FindAllStringSubmatch(cve, -1) if len(match) > 0 { s := match[0] - severity := strings.Replace(s[1], "major", string(common.High), -1) - severity = strings.Replace(severity, "medium", string(common.Medium), -1) - severity = strings.Replace(severity, "low", string(common.Low), -1) + severity := strings.ReplaceAll(s[1], "major", string(common.High)) + severity = strings.ReplaceAll(severity, "medium", string(common.Medium)) + severity = strings.ReplaceAll(severity, "low", string(common.Low)) modVul.Severity = common.Priority(severity) } else { continue @@ -111,8 +111,8 @@ func nginxUpdate() error { } } -//0.6.18-1.9.9 -//1.1.4-1.2.8, 1.3.9-1.4.0 +// 0.6.18-1.9.9 +// 1.1.4-1.2.8, 1.3.9-1.4.0 var versionAffectedRegexp1 = regexp.MustCompile(`([0-9\.]+)\-([0-9\.]+)`) var versionAffectedRegexp2 = regexp.MustCompile(`([0-9\.]+)`) @@ -162,7 +162,7 @@ func getFixedVersion(str string) []common.AppModuleVersion { match := versionFixedRegexp.FindAllStringSubmatch(str, -1) for _, s := range match { if len(s) == 2 { - v := strings.Replace(s[1], "+", "", -1) + v := strings.ReplaceAll(s[1], "+", "") mv := common.AppModuleVersion{OpCode: "gteq", Version: v} modVerArr = append(modVerArr, mv) } diff --git a/updater/fetchers/apps/openssl.go b/updater/fetchers/apps/openssl.go index fe5e581..56ae678 100644 --- a/updater/fetchers/apps/openssl.go +++ b/updater/fetchers/apps/openssl.go @@ -3,7 +3,7 @@ package apps import ( "errors" "fmt" - "io/ioutil" + "io" "net/http" "regexp" "strings" @@ -36,7 +36,7 @@ func opensslUpdate() error { return err } - body, _ := ioutil.ReadAll(r.Body) + body, _ := io.ReadAll(r.Body) defer r.Body.Close() cves := strings.Split(string(body), "h3 id") diff --git a/updater/fetchers/apps/ruby.go b/updater/fetchers/apps/ruby.go index 54193e0..6df9beb 100644 --- a/updater/fetchers/apps/ruby.go +++ b/updater/fetchers/apps/ruby.go @@ -2,7 +2,6 @@ package apps import ( "fmt" - "io/ioutil" "os" "os/exec" "regexp" @@ -21,7 +20,7 @@ const rubyGitUrl = "https://github.com/rubysec/ruby-advisory-db" func rubyUpdate() error { log.Debug("") - repositoryLocalPath, err := ioutil.TempDir(os.TempDir(), "ruby-advisory-db") + repositoryLocalPath, err := os.MkdirTemp(os.TempDir(), "ruby-advisory-db") if err != nil { return fmt.Errorf("something went wrong when interacting with the fs") } @@ -108,7 +107,7 @@ type rubyVul struct { func parseRubyYml(yaml string) *rubyVul { m := make(map[interface{}]interface{}) - data, _ := ioutil.ReadFile(yaml) + data, _ := os.ReadFile(yaml) err := yamlv2.Unmarshal([]byte(data), &m) if err != nil { return nil @@ -249,10 +248,10 @@ func getOperation(op string, rev bool) string { } } -//~> 4.2.5, >= 4.2.5.1 -//>= 2.12.5, < 3.0.0 -//~> 3.9.5 -//>= 1.9.24 +// ~> 4.2.5, >= 4.2.5.1 +// >= 2.12.5, < 3.0.0 +// ~> 3.9.5 +// >= 1.9.24 var ver1Regex = regexp.MustCompile(`~> ([0-9a-zA-Z\.]+), >= ([0-9a-zA-Z\.]+)`) var ver2Regex = regexp.MustCompile(`([\<\>\=]+) ([0-9a-zA-Z\.]+), ([\<\>\=]+) ([0-9a-zA-Z\.]+)`) var ver3Regex = regexp.MustCompile(`~> ([0-9a-zA-Z\.]+)`) diff --git a/updater/fetchers/chainguardv2/chainguardv2.go b/updater/fetchers/chainguardv2/chainguardv2.go index dca4b43..d447aa0 100644 --- a/updater/fetchers/chainguardv2/chainguardv2.go +++ b/updater/fetchers/chainguardv2/chainguardv2.go @@ -16,7 +16,8 @@ import ( const ( chainguardOSVZipPath = "chainguard/osv-v2.zip" - advisoryURL = "https://advisories.cgr.dev/chainguard/v2/osv/%s.json" + advisoryURLPrefix = "https://advisories.cgr.dev/chainguard/v2/osv/" + advisoryURLSuffix = ".json" cveURLPrefix = "https://cve.mitre.org/cgi-bin/cvename.cgi?name=" chainguardNamespace = "chainguard" wolfiNamespace = "wolfi" @@ -41,7 +42,7 @@ func FetchVulnerabilities(targetEcosystem, targetNamespace string) ([]common.Vul return nil, fmt.Errorf("unsupported namespace: %s", targetNamespace) } - dataFile := fmt.Sprintf("%s%s", common.CVESourceRoot, chainguardOSVZipPath) + dataFile := common.CVESourceRoot + chainguardOSVZipPath zipReader, err := zip.OpenReader(dataFile) if err != nil { return nil, fmt.Errorf("failed to open Chainguard OSV v2 zip file %s: %w", dataFile, err) @@ -149,7 +150,7 @@ func parseAdvisory(body []byte, targetEcosystem, targetNamespace string) ([]comm modified = adv.Modified.AsTime() } - advisoryLink := fmt.Sprintf(advisoryURL, adv.Id) + advisoryLink := advisoryURLPrefix + adv.Id + advisoryURLSuffix vulnMap := make(map[string]*common.Vulnerability, len(cves)) existFeatures := make(map[string]map[featureKey]struct{}, len(cves)) diff --git a/updater/fetchers/debian/debian.go b/updater/fetchers/debian/debian.go index da1b41d..b09a0b4 100644 --- a/updater/fetchers/debian/debian.go +++ b/updater/fetchers/debian/debian.go @@ -68,7 +68,7 @@ func (fetcher *DebianFetcher) FetchUpdate() (resp updater.FetcherResponse, err e var reader io.Reader - jsonFile := fmt.Sprintf("%s%s", common.CVESourceRoot, debianJsonFile) + jsonFile := common.CVESourceRoot + debianJsonFile if f, err := os.Open(jsonFile); err == nil { log.Debug("Use local Debian database") @@ -110,7 +110,7 @@ func (fetcher *DebianFetcher) FetchUpdate() (resp updater.FetcherResponse, err e for _, file := range additionalDebianFiles { //Open json - jsonFile := fmt.Sprintf("%s%s", common.CVESourceRoot, file) + jsonFile := common.CVESourceRoot + file if f, err := os.Open(jsonFile); err == nil { log.WithFields(log.Fields{"file": file}).Debug("Using local Debian source") defer f.Close() diff --git a/updater/fetchers/mariner/mariner.go b/updater/fetchers/mariner/mariner.go index a4f3eda..0a611fd 100644 --- a/updater/fetchers/mariner/mariner.go +++ b/updater/fetchers/mariner/mariner.go @@ -4,7 +4,6 @@ import ( "bufio" "encoding/xml" "errors" - "fmt" "io" "os" "strings" @@ -112,7 +111,7 @@ func (fetcher *MarinerFetcher) FetchUpdate() (resp updater.FetcherResponse, err //Load each file for _, marinerFile := range marinerFiles { - file, err := os.Open(fmt.Sprintf("%s/%s/%s", common.CVESourceRoot, marinerFolder, marinerFile)) + file, err := os.Open(common.CVESourceRoot + "/" + marinerFolder + "/" + marinerFile) if err != nil { return resp, err } @@ -285,11 +284,13 @@ func toFeatureVersions(cvename string, criteria criteria, stateMap map[string]st test := tstMap[criterionTestVersion] objectID, err := getReferenceNum(test.Object.ObjectReference) if err != nil { - fmt.Println(err) + log.WithError(err).WithField("test_ref", criterion.TestRef).Warn("Failed to parse Mariner object reference") + continue } stateID, err := getReferenceNum(test.State.StateReference) if err != nil { - fmt.Println(err) + log.WithError(err).WithField("test_ref", criterion.TestRef).Warn("Failed to parse Mariner state reference") + continue } pkgName := objMap[objectID].Name state := stateMap[stateID] diff --git a/updater/fetchers/oracle/oracle.go b/updater/fetchers/oracle/oracle.go index 2f3182d..a065799 100644 --- a/updater/fetchers/oracle/oracle.go +++ b/updater/fetchers/oracle/oracle.go @@ -122,7 +122,7 @@ func (f *OracleFetcher) FetchUpdate() (resp updater.FetcherResponse, err error) retry := 0 for retry <= retryTimes { - rurl := fmt.Sprintf("%s%s", ovalURI, elsaFile) + rurl := ovalURI + elsaFile client := http.Client{} req, err := http.NewRequest("GET", rurl, nil) @@ -474,9 +474,9 @@ func toFeatureVersions(cvename string, criteria criteria) []common.FeatureVersio func description(def definition) (desc string) { // It is much more faster to proceed like this than using a Replacer. - desc = strings.Replace(def.Description, "\n\n\n", " ", -1) - desc = strings.Replace(desc, "\n\n", " ", -1) - desc = strings.Replace(desc, "\n", " ", -1) + desc = strings.ReplaceAll(def.Description, "\n\n\n", " ") + desc = strings.ReplaceAll(desc, "\n\n", " ") + desc = strings.ReplaceAll(desc, "\n", " ") return } diff --git a/updater/fetchers/photon/photon.go b/updater/fetchers/photon/photon.go index 4098cf1..e6ebe60 100644 --- a/updater/fetchers/photon/photon.go +++ b/updater/fetchers/photon/photon.go @@ -3,8 +3,8 @@ package alpine import ( "compress/gzip" "encoding/json" - "fmt" "os" + "strconv" log "github.com/sirupsen/logrus" @@ -85,7 +85,7 @@ func (f *PhotonFetcher) FetchUpdate() (resp updater.FetcherResponse, err error) func (f *PhotonFetcher) fetchLocal(files []photonFile) ([]common.Vulnerability, error) { results := []common.Vulnerability{} for _, file := range files { - dataFile := fmt.Sprintf("%s%s", common.CVESourceRoot, file.Name) + dataFile := common.CVESourceRoot + file.Name f, err := os.Open(dataFile) if err != nil { log.WithFields(log.Fields{"file": dataFile}).Error("Cannot find local database") @@ -109,7 +109,7 @@ func (f *PhotonFetcher) fetchLocal(files []photonFile) ([]common.Vulnerability, } for _, vuln := range r { - namespace := fmt.Sprintf("photon:%v", file.Version) + namespace := "photon:" + strconv.FormatFloat(file.Version, 'f', -1, 64) if vuln.ResolvedVersion == "N/A" || vuln.ResolvedVersion == "NA" { vuln.ResolvedVersion = common.MaxVersion.String() } diff --git a/updater/fetchers/rhel2/rhel.go b/updater/fetchers/rhel2/rhel.go index 65a80f3..94b4d29 100644 --- a/updater/fetchers/rhel2/rhel.go +++ b/updater/fetchers/rhel2/rhel.go @@ -6,7 +6,6 @@ import ( "encoding/xml" "fmt" "io" - "io/ioutil" "net/http" "os" "regexp" @@ -122,7 +121,7 @@ func (f *RHELCpeFetcher) FetchUpdate() (updater.RawFetcherResponse, error) { log.WithFields(log.Fields{"error": err}).Error("Could not download CPE mapping json") return resp, err } - body, _ := ioutil.ReadAll(r.Body) + body, _ := io.ReadAll(r.Body) r.Body.Close() log.WithFields(log.Fields{"size": len(body), "file": common.RHELCpeMapFile}).Info("fetching Red Hat CPE map done") @@ -135,8 +134,8 @@ func (f *RHELFetcher) fetchPreDownload(rhelFolder string) ([]common.Vulnerabilit var results []common.Vulnerability for _, ros := range rhsaOS { - folder := fmt.Sprintf("%s/%d", rhelFolder, ros) - files, err := ioutil.ReadDir(folder) + folder := rhelFolder + "/" + strconv.Itoa(ros) + files, err := os.ReadDir(folder) if err != nil { return nil, err } @@ -144,7 +143,7 @@ func (f *RHELFetcher) fetchPreDownload(rhelFolder string) ([]common.Vulnerabilit if strings.HasSuffix(f.Name(), ".xml.bz2") { log.WithFields(log.Fields{"os": ros, "file": f.Name()}).Debug("Read redhat feed") - rfp, err := os.Open(fmt.Sprintf("%s/%s", folder, f.Name())) + rfp, err := os.Open(folder + "/" + f.Name()) cr := bzip2.NewReader(rfp) vs, err := parseRHSA(ros, f.Name(), cr) rfp.Close() @@ -166,7 +165,7 @@ func (f *RHELFetcher) fetchRemote() ([]common.Vulnerability, error) { var results []common.Vulnerability for _, ros := range rhsaOS { - rurl := fmt.Sprintf("%sRHEL%d/", ovalURI2, ros) + rurl := ovalURI2 + "RHEL" + strconv.Itoa(ros) + "/" req, err := http.NewRequest("GET", rurl, nil) req.Header.Add("User-Agent", "dbgen") client := http.Client{} @@ -200,7 +199,7 @@ func (f *RHELFetcher) fetchRemote() ([]common.Vulnerability, error) { retry := 0 for retry <= retryTimes { client := http.Client{} - rurl = fmt.Sprintf("%sRHEL%d/%s", ovalURI2, ros, rhsa) + rurl = ovalURI2 + "RHEL" + strconv.Itoa(ros) + "/" + rhsa req, err := http.NewRequest("GET", rurl, nil) req.Header.Add("User-Agent", "dbgen") r, err := client.Do(req) @@ -247,7 +246,7 @@ func (f *RHELFetcher) FetchUpdate() (resp updater.FetcherResponse, err error) { var results []common.Vulnerability - rhelFolder := fmt.Sprintf("%s/%s", common.CVESourceRoot, rhelSubfolder) + rhelFolder := common.CVESourceRoot + "/" + rhelSubfolder if _, err = os.Stat(rhelFolder); os.IsNotExist(err) { results, err = f.fetchRemote() } else { @@ -284,7 +283,7 @@ func cullAllVulns(respVuln []common.Vulnerability) []common.Vulnerability { cullVulns(rhsamap, cveMap) //add the rhsas back to the cves after culling for _, val := range rhsas { - key := fmt.Sprintf("%v:%v", val.Namespace, val.Name) + key := val.Namespace + ":" + val.Name cveMap[key] = val } @@ -300,7 +299,7 @@ func makeCveMap(allVulns []common.Vulnerability) map[string]common.Vulnerability cveMap := make(map[string]common.Vulnerability) for _, vuln := range allVulns { - key := fmt.Sprintf("%s:%s", vuln.Namespace, vuln.Name) + key := vuln.Namespace + ":" + vuln.Name if exist, ok := cveMap[key]; !ok { // entry doesn't exist, create it. @@ -327,7 +326,7 @@ func makeCveMap(allVulns []common.Vulnerability) map[string]common.Vulnerability return cveMap } -//getRHSACVEs returns a map of all CVE names to the matching RHSA entries. +// getRHSACVEs returns a map of all CVE names to the matching RHSA entries. func getRHSACVEs(fullVulns map[string]common.Vulnerability) (map[string][]common.Vulnerability, map[string]common.Vulnerability, map[string]common.Vulnerability) { result := make(map[string][]common.Vulnerability) cves := make(map[string]common.Vulnerability) @@ -335,10 +334,10 @@ func getRHSACVEs(fullVulns map[string]common.Vulnerability) (map[string][]common for _, vuln := range fullVulns { if strings.Contains(strings.ToLower(vuln.Name), "rhsa") { - rhsaskey := fmt.Sprintf("%s:%s", vuln.Namespace, vuln.Name) + rhsaskey := vuln.Namespace + ":" + vuln.Name rhsas[rhsaskey] = vuln for _, cve := range vuln.CVEs { - key := fmt.Sprintf("%s:%s", vuln.Namespace, cve.Name) + key := vuln.Namespace + ":" + cve.Name //if slice doesn't exist if _, ok := result[key]; !ok { //if the data exists, initialize the slice @@ -354,7 +353,7 @@ func getRHSACVEs(fullVulns map[string]common.Vulnerability) (map[string][]common } } else { //cve case - key := fmt.Sprintf("%s:%s", vuln.Namespace, vuln.Name) + key := vuln.Namespace + ":" + vuln.Name if _, ok := cves[key]; !ok { //entry doesn't exist, create it. cves[key] = vuln @@ -366,7 +365,7 @@ func getRHSACVEs(fullVulns map[string]common.Vulnerability) (map[string][]common func cullVulns(rhsamap map[string][]common.Vulnerability, cvemap map[string]common.Vulnerability) { for cvekey, vuln := range cvemap { - key := fmt.Sprintf("%s:%s", vuln.Namespace, vuln.Name) + key := vuln.Namespace + ":" + vuln.Name remainingFeatures := vuln.FixedIn if rhsas, ok := rhsamap[key]; ok { for _, rhsa := range rhsas { @@ -385,7 +384,7 @@ func cullVulns(rhsamap map[string][]common.Vulnerability, cvemap map[string]comm } } -//removeMatchingFeatures removes entries in entryA that match an entry in entryB +// removeMatchingFeatures removes entries in entryA that match an entry in entryB func removeMatchingFeatures(entryA []common.FeatureVersion, entryB []common.FeatureVersion) []common.FeatureVersion { result := make([]common.FeatureVersion, 0) foundFeatures := make(map[string]bool) @@ -666,9 +665,9 @@ func toFeatureVersions(ros int, rhsa, cvename string, criteria criteria) []commo func description(def definition) (desc string) { // It is much more faster to proceed like this than using a Replacer. - desc = strings.Replace(def.Description, "\n\n\n", " ", -1) - desc = strings.Replace(desc, "\n\n", " ", -1) - desc = strings.Replace(desc, "\n", " ", -1) + desc = strings.ReplaceAll(def.Description, "\n\n\n", " ") + desc = strings.ReplaceAll(desc, "\n\n", " ") + desc = strings.ReplaceAll(desc, "\n", " ") return } diff --git a/updater/fetchers/rocky/rocky.go b/updater/fetchers/rocky/rocky.go index b499369..8dca776 100644 --- a/updater/fetchers/rocky/rocky.go +++ b/updater/fetchers/rocky/rocky.go @@ -121,10 +121,10 @@ func productNameToNamespace(productName string) string { for _, f := range fields { if v, err := strconv.ParseFloat(f, 64); err == nil { // Only convert to the floor value of the float, e.g. 9.6 -> 9 - return fmt.Sprintf("rocky:%d", int(v)) + return "rocky:" + strconv.Itoa(int(v)) } } - return fmt.Sprintf("rocky:%s", productName) + return "rocky:" + productName } // extractVersionFromNevra parses a NEVRA-formatted RPM string to extract the version. @@ -178,7 +178,7 @@ func buildFixedInByNamespace(affectedProducts []affectedProduct, packages []pkg) // rocky:9.4 => [8.0.6-2.el10_1] => common.FeatureVersion(8.0.6-2.el10_1) packagesByNamespace := make(map[string]map[string]common.FeatureVersion) for _, affectedProduct := range affectedProducts { - packagesByNamespace[fmt.Sprintf("rocky:%d", affectedProduct.MajorVersion)] = make(map[string]common.FeatureVersion) + packagesByNamespace["rocky:"+strconv.Itoa(affectedProduct.MajorVersion)] = make(map[string]common.FeatureVersion) } for _, pkg := range packages { @@ -282,7 +282,7 @@ func fetchRockyLinuxErrata(ctx context.Context) (*apiResponse, error) { page := 1 for { - url := fmt.Sprintf("%s?page=%d&size=%d", baseURL, page, pageSize) + url := baseURL + "?page=" + strconv.Itoa(page) + "&size=" + strconv.Itoa(pageSize) req, err := retryablehttp.NewRequestWithContext(ctx, "GET", url, nil) if err != nil { diff --git a/updater/fetchers/suse/suse.go b/updater/fetchers/suse/suse.go index edf9fa7..f375c93 100644 --- a/updater/fetchers/suse/suse.go +++ b/updater/fetchers/suse/suse.go @@ -151,7 +151,7 @@ func (f *SuseFetcher) fetchOvalData(o *ovalInfo) (updater.FetcherResponse, error var resp updater.FetcherResponse - fullname := fmt.Sprintf("%s%s", common.CVESourceRoot, o.filename) + fullname := common.CVESourceRoot + o.filename file, err := os.Open(fullname) if err != nil { log.WithFields(log.Fields{"file": o.filename}).Error("Failed to open the feed file") @@ -378,7 +378,7 @@ func parsePackageVersions(o *ovalInfo, cvename string, criteria criteria, testMa if _, ok := noVersion[o.filename]; ok { fv.Feature.Namespace = o.nsPrefix } else { - fv.Feature.Namespace = fmt.Sprintf("%s%s", o.nsPrefix, ti.version) + fv.Feature.Namespace = o.nsPrefix + ti.version.String() } } } else if !strings.HasPrefix(c.Comment, "SUSE") && (strings.Contains(c.Comment, " is installed") || strings.Contains(c.Comment, " is not affected")) { @@ -417,9 +417,9 @@ func parsePackageVersions(o *ovalInfo, cvename string, criteria criteria, testMa func description(def definition) (desc string) { // It is much more faster to proceed like this than using a Replacer. - desc = strings.Replace(def.Description, "\n\n\n", " ", -1) - desc = strings.Replace(desc, "\n\n", " ", -1) - desc = strings.Replace(desc, "\n", " ", -1) + desc = strings.ReplaceAll(def.Description, "\n\n\n", " ") + desc = strings.ReplaceAll(desc, "\n\n", " ") + desc = strings.ReplaceAll(desc, "\n", " ") return } diff --git a/updater/fetchers/ubuntu/ubuntu.go b/updater/fetchers/ubuntu/ubuntu.go index 6f10c92..e1709f3 100644 --- a/updater/fetchers/ubuntu/ubuntu.go +++ b/updater/fetchers/ubuntu/ubuntu.go @@ -20,7 +20,6 @@ import ( "errors" "fmt" "io" - "io/ioutil" "os" "regexp" "strconv" @@ -36,7 +35,7 @@ import ( const ( trackerURI = "https://launchpad.net/ubuntu-cve-tracker" trackerRepository = "https://git.launchpad.net/ubuntu-cve-tracker" - cveURL = "http://people.ubuntu.com/~ubuntu-security/cve/%s" + cveURL = "http://people.ubuntu.com/~ubuntu-security/cve/" ubuntuFolder = "ubuntu-cve-tracker" maxRetryTimes = 5 ) @@ -92,7 +91,7 @@ func init() { func (fetcher *UbuntuFetcher) FetchUpdate() (resp updater.FetcherResponse, err error) { log.Info("fetching Ubuntu vulnerabilities") - dbDir := fmt.Sprintf("%s%s", common.CVESourceRoot, ubuntuFolder) + dbDir := common.CVESourceRoot + ubuntuFolder if info, err := os.Stat(dbDir); err == nil && info.IsDir() { log.Debug("Use local Ubuntu database") fetcher.repositoryLocalPath = dbDir @@ -148,7 +147,7 @@ func (fetcher *UbuntuFetcher) FetchUpdate() (resp updater.FetcherResponse, err e // Store any unknown releases as notes. for k := range unknownReleases { - note := fmt.Sprintf("Ubuntu %s is not mapped to any version number (eg. trusty->14.04). Please update me.", k) + note := "Ubuntu " + k + " is not mapped to any version number (eg. trusty->14.04). Please update me." notes[note] = struct{}{} // If we encountered unknown Ubuntu release, we don't want the revision @@ -177,7 +176,7 @@ func (fetcher *UbuntuFetcher) pullRepository() (err error) { // Determine whether we should branch or pull. if _, pathExists := os.Stat(fetcher.repositoryLocalPath); fetcher.repositoryLocalPath == "" || os.IsNotExist(pathExists) { // Create a temporary folder to store the repository. - if fetcher.repositoryLocalPath, err = ioutil.TempDir(os.TempDir(), "ubuntu-cve-tracker"); err != nil { + if fetcher.repositoryLocalPath, err = os.MkdirTemp(os.TempDir(), "ubuntu-cve-tracker"); err != nil { return ErrFilesystem } } @@ -294,7 +293,7 @@ func parseUbuntuCVE(fileContent io.Reader) (vulnerability common.Vulnerability, // Parse the name. if strings.HasPrefix(line, "Candidate:") { vulnerability.Name = strings.TrimSpace(strings.TrimPrefix(line, "Candidate:")) - vulnerability.Link = fmt.Sprintf(cveURL, vulnerability.Name) + vulnerability.Link = cveURL + vulnerability.Name continue } diff --git a/updater/nvd/xml.go b/updater/nvd/xml.go index 9cfbfbd..73731e8 100644 --- a/updater/nvd/xml.go +++ b/updater/nvd/xml.go @@ -1,7 +1,6 @@ package nvd import ( - "fmt" "strings" log "github.com/sirupsen/logrus" @@ -78,7 +77,7 @@ func (n nvdCVSSBaseMetrics) String() string { func addVec(str *string, vec, val string) { if val != "" { if let, ok := vectorValuesToLetters[val]; ok { - *str = fmt.Sprintf("%s%s:%s/", *str, vec, let) + *str += vec + ":" + let + "/" } else { log.Printf("unknown value '%v' for CVSSv2 vector '%s'", val, vec) }