fix: extract osv package string literals to constants
goconst counts occurrences across the whole package (including test files) when deciding whether to flag a non-test file — the exclusion only suppresses reports FROM test files. Add unexported constants for severity levels, CVSS types, ecosystem, and reference types in client.go, and update client_test.go to use them so the total raw-string count per literal drops below threshold.
This commit is contained in:
CarterPerez-dev
parent
25671b4f9d
commit
7d69339413
|
|
@ -43,6 +43,16 @@ const (
|
|||
vulnEndpoint = "https://api.osv.dev/v1/vulns/"
|
||||
userAgent = "angela/0.1.0 (https://github.com/CarterPerez-dev/angela)"
|
||||
maxHydrate = 15
|
||||
|
||||
ecosystemPyPI = "PyPI"
|
||||
cvssTypeV3 = "CVSS_V3"
|
||||
cvssTypeV4 = "CVSS_V4"
|
||||
sevCritical = "CRITICAL"
|
||||
sevHigh = "HIGH"
|
||||
sevModerate = "MODERATE"
|
||||
sevLow = "LOW"
|
||||
refTypeWeb = "WEB"
|
||||
refTypeReport = "REPORT"
|
||||
)
|
||||
|
||||
// Client queries the OSV.dev API for known vulnerabilities
|
||||
|
|
@ -161,7 +171,7 @@ func (c *Client) queryBatch(
|
|||
queries := make([]query, len(packages))
|
||||
for i, p := range packages {
|
||||
queries[i] = query{
|
||||
Package: pkg{Name: p.Name, Ecosystem: "PyPI"},
|
||||
Package: pkg{Name: p.Name, Ecosystem: ecosystemPyPI},
|
||||
Version: p.Version,
|
||||
}
|
||||
}
|
||||
|
|
@ -346,7 +356,7 @@ func toVulnerability(v *osvVuln) types.Vulnerability {
|
|||
|
||||
func extractSeverity(v *osvVuln) string {
|
||||
for _, s := range v.Severity {
|
||||
if s.Type != "CVSS_V3" && s.Type != "CVSS_V4" {
|
||||
if s.Type != cvssTypeV3 && s.Type != cvssTypeV4 {
|
||||
continue
|
||||
}
|
||||
|
||||
|
|
@ -374,13 +384,13 @@ func extractSeverity(v *osvVuln) string {
|
|||
func classifyScore(score float64) string {
|
||||
switch {
|
||||
case score >= 9.0:
|
||||
return "CRITICAL"
|
||||
return sevCritical
|
||||
case score >= 7.0:
|
||||
return "HIGH"
|
||||
return sevHigh
|
||||
case score >= 4.0:
|
||||
return "MODERATE"
|
||||
return sevModerate
|
||||
case score > 0:
|
||||
return "LOW"
|
||||
return sevLow
|
||||
default:
|
||||
return "NONE"
|
||||
}
|
||||
|
|
@ -388,7 +398,7 @@ func classifyScore(score float64) string {
|
|||
|
||||
func extractFixed(affected []affected) string {
|
||||
for _, a := range affected {
|
||||
if !strings.EqualFold(a.Package.Ecosystem, "PyPI") {
|
||||
if !strings.EqualFold(a.Package.Ecosystem, ecosystemPyPI) {
|
||||
continue
|
||||
}
|
||||
for _, r := range a.Ranges {
|
||||
|
|
@ -409,7 +419,7 @@ func extractLink(refs []reference) string {
|
|||
}
|
||||
}
|
||||
for _, r := range refs {
|
||||
if r.Type == "WEB" || r.Type == "REPORT" {
|
||||
if r.Type == refTypeWeb || r.Type == refTypeReport {
|
||||
return r.URL
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -24,11 +24,11 @@ func TestExtractSeverityCVSSV3(t *testing.T) {
|
|||
|
||||
v := &osvVuln{
|
||||
Severity: []severity{
|
||||
{Type: "CVSS_V3", Score: "9.8"},
|
||||
{Type: cvssTypeV3, Score: "9.8"},
|
||||
},
|
||||
}
|
||||
got := extractSeverity(v)
|
||||
if got != "CRITICAL" { //nolint:goconst
|
||||
if got != sevCritical {
|
||||
t.Errorf("extractSeverity = %q, want CRITICAL", got)
|
||||
}
|
||||
}
|
||||
|
|
@ -38,11 +38,11 @@ func TestExtractSeverityCVSSV4(t *testing.T) {
|
|||
|
||||
v := &osvVuln{
|
||||
Severity: []severity{
|
||||
{Type: "CVSS_V4", Score: "7.5"},
|
||||
{Type: cvssTypeV4, Score: "7.5"},
|
||||
},
|
||||
}
|
||||
got := extractSeverity(v)
|
||||
if got != "HIGH" {
|
||||
if got != sevHigh {
|
||||
t.Errorf("extractSeverity = %q, want HIGH", got)
|
||||
}
|
||||
}
|
||||
|
|
@ -53,13 +53,13 @@ func TestExtractSeverityCVSSVector(t *testing.T) {
|
|||
v := &osvVuln{
|
||||
Severity: []severity{
|
||||
{
|
||||
Type: "CVSS_V3",
|
||||
Type: cvssTypeV3,
|
||||
Score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/9.8",
|
||||
},
|
||||
},
|
||||
}
|
||||
got := extractSeverity(v)
|
||||
if got != "CRITICAL" {
|
||||
if got != sevCritical {
|
||||
t.Errorf("extractSeverity = %q, want CRITICAL", got)
|
||||
}
|
||||
}
|
||||
|
|
@ -69,11 +69,11 @@ func TestExtractSeverityDatabaseSpecific(t *testing.T) {
|
|||
|
||||
v := &osvVuln{
|
||||
DatabaseSpecific: map[string]any{
|
||||
"severity": "MODERATE",
|
||||
"severity": sevModerate,
|
||||
},
|
||||
}
|
||||
got := extractSeverity(v)
|
||||
if got != "MODERATE" {
|
||||
if got != sevModerate {
|
||||
t.Errorf("extractSeverity = %q, want MODERATE", got)
|
||||
}
|
||||
}
|
||||
|
|
@ -95,14 +95,14 @@ func TestClassifyScore(t *testing.T) {
|
|||
score float64
|
||||
want string
|
||||
}{
|
||||
{9.8, "CRITICAL"},
|
||||
{9.0, "CRITICAL"},
|
||||
{8.5, "HIGH"},
|
||||
{7.0, "HIGH"},
|
||||
{6.9, "MODERATE"},
|
||||
{4.0, "MODERATE"},
|
||||
{3.9, "LOW"},
|
||||
{0.1, "LOW"},
|
||||
{9.8, sevCritical},
|
||||
{9.0, sevCritical},
|
||||
{8.5, sevHigh},
|
||||
{7.0, sevHigh},
|
||||
{6.9, sevModerate},
|
||||
{4.0, sevModerate},
|
||||
{3.9, sevLow},
|
||||
{0.1, sevLow},
|
||||
{0.0, "NONE"},
|
||||
}
|
||||
|
||||
|
|
@ -154,7 +154,7 @@ func TestExtractFixed(t *testing.T) {
|
|||
|
||||
aff := []affected{
|
||||
{
|
||||
Package: pkg{Name: "django", Ecosystem: "PyPI"},
|
||||
Package: pkg{Name: "django", Ecosystem: ecosystemPyPI},
|
||||
Ranges: []rng{
|
||||
{
|
||||
Type: "ECOSYSTEM",
|
||||
|
|
@ -178,7 +178,7 @@ func TestExtractFixedNoFix(t *testing.T) {
|
|||
|
||||
aff := []affected{
|
||||
{
|
||||
Package: pkg{Name: "django", Ecosystem: "PyPI"},
|
||||
Package: pkg{Name: "django", Ecosystem: ecosystemPyPI},
|
||||
Ranges: []rng{
|
||||
{
|
||||
Type: "ECOSYSTEM",
|
||||
|
|
@ -198,7 +198,7 @@ func TestExtractLink(t *testing.T) {
|
|||
t.Parallel()
|
||||
|
||||
refs := []reference{
|
||||
{Type: "WEB", URL: "https://example.com"},
|
||||
{Type: refTypeWeb, URL: "https://example.com"},
|
||||
{
|
||||
Type: "ADVISORY",
|
||||
URL: "https://nvd.nist.gov/vuln/detail/CVE-2023-1234",
|
||||
|
|
@ -216,7 +216,7 @@ func TestExtractLinkFallback(t *testing.T) {
|
|||
|
||||
refs := []reference{
|
||||
{Type: "PACKAGE", URL: "https://pypi.org/project/django"},
|
||||
{Type: "WEB", URL: "https://example.com/info"},
|
||||
{Type: refTypeWeb, URL: "https://example.com/info"},
|
||||
}
|
||||
|
||||
got := extractLink(refs)
|
||||
|
|
|
|||
Loading…
Reference in New Issue