whatcanGOwrong

go/pkg/mod/golang.org/x/vuln@v1.0.4/internal/test/buildtest.go

@@ -0,0 +1,101 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package test
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"golang.org/x/vuln/internal/testenv"
+)
+
+var unsupportedGoosGoarch = map[string]bool{
+	"darwin/386": true,
+	"darwin/arm": true,
+}
+
+// GoBuild runs "go build" on dir using the additional environment variables in
+// envVarVals, which should be an alternating list of variables and values.
+// It returns the path to the resulting binary, and a function
+// to call when finished with the binary.
+func GoBuild(t *testing.T, dir, tags string, strip bool, envVarVals ...string) (binaryPath string, cleanup func()) {
+	testenv.NeedsGoBuild(t)
+
+	if len(envVarVals)%2 != 0 {
+		t.Fatal("last args should be alternating variables and values")
+	}
+	var env []string
+	if len(envVarVals) > 0 {
+		env = os.Environ()
+		for i := 0; i < len(envVarVals); i += 2 {
+			env = append(env, fmt.Sprintf("%s=%s", envVarVals[i], envVarVals[i+1]))
+		}
+	}
+
+	gg := lookupEnv("GOOS", env, runtime.GOOS) + "/" + lookupEnv("GOARCH", env, runtime.GOARCH)
+	if unsupportedGoosGoarch[gg] {
+		t.Skipf("skipping unsupported GOOS/GOARCH pair %s", gg)
+	}
+
+	tmpDir, err := os.MkdirTemp("", "buildtest")
+	if err != nil {
+		t.Fatal(err)
+	}
+	abs, err := filepath.Abs(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	binaryPath = filepath.Join(tmpDir, filepath.Base(abs))
+	var exeSuffix string
+	if runtime.GOOS == "windows" {
+		exeSuffix = ".exe"
+	}
+	// Make sure we use the same version of go that is running this test.
+	goCommandPath := filepath.Join(runtime.GOROOT(), "bin", "go"+exeSuffix)
+	if _, err := os.Stat(goCommandPath); err != nil {
+		t.Fatal(err)
+	}
+	args := []string{"build", "-o", binaryPath + exeSuffix}
+	if tags != "" {
+		args = append(args, "-tags", tags)
+	}
+	if strip {
+		args = append(args, "-ldflags", "-s -w")
+	}
+	cmd := exec.Command(goCommandPath, args...)
+	cmd.Dir = dir
+	cmd.Env = env
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		if ee := (*exec.ExitError)(nil); errors.As(err, &ee) && len(ee.Stderr) > 0 {
+			t.Fatalf("%v: %v\n%s", cmd, err, ee.Stderr)
+		}
+		t.Fatalf("%v: %v", cmd, err)
+	}
+	return binaryPath + exeSuffix, func() { os.RemoveAll(tmpDir) }
+}
+
+// lookEnv looks for name in env, a list of "VAR=VALUE" strings. It returns
+// the value if name is found, and defaultValue if it is not.
+func lookupEnv(name string, env []string, defaultValue string) string {
+	for _, vv := range env {
+		i := strings.IndexByte(vv, '=')
+		if i < 0 {
+			// malformed env entry; just ignore it
+			continue
+		}
+		if name == vv[:i] {
+			return vv[i+1:]
+		}
+	}
+	return defaultValue
+}

go/pkg/mod/golang.org/x/vuln@v1.0.4/internal/test/handler.go

@@ -0,0 +1,113 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package test
+
+import (
+	"sort"
+
+	"golang.org/x/vuln/internal/govulncheck"
+	"golang.org/x/vuln/internal/osv"
+)
+
+// MockHandler implements govulncheck.Handler but (currently)
+// does nothing.
+//
+// For use in tests.
+type MockHandler struct {
+	ConfigMessages   []*govulncheck.Config
+	ProgressMessages []*govulncheck.Progress
+	OSVMessages      []*osv.Entry
+	FindingMessages  []*govulncheck.Finding
+}
+
+func NewMockHandler() *MockHandler {
+	return &MockHandler{}
+}
+
+func (h *MockHandler) Config(config *govulncheck.Config) error {
+	h.ConfigMessages = append(h.ConfigMessages, config)
+	return nil
+}
+
+func (h *MockHandler) Progress(progress *govulncheck.Progress) error {
+	h.ProgressMessages = append(h.ProgressMessages, progress)
+	return nil
+}
+
+func (h *MockHandler) OSV(entry *osv.Entry) error {
+	h.OSVMessages = append(h.OSVMessages, entry)
+	return nil
+}
+
+func (h *MockHandler) Finding(finding *govulncheck.Finding) error {
+	h.FindingMessages = append(h.FindingMessages, finding)
+	return nil
+}
+
+func (h *MockHandler) Sort() {
+	sort.Slice(h.FindingMessages, func(i, j int) bool {
+		if h.FindingMessages[i].OSV > h.FindingMessages[j].OSV {
+			return true
+		}
+		if h.FindingMessages[i].OSV < h.FindingMessages[j].OSV {
+			return false
+		}
+
+		iframe := h.FindingMessages[i].Trace[0]
+		jframe := h.FindingMessages[j].Trace[0]
+		if iframe.Module < jframe.Module {
+			return true
+		}
+		if iframe.Module > jframe.Module {
+			return false
+		}
+		if iframe.Package < jframe.Package {
+			return true
+		}
+		if iframe.Package > jframe.Package {
+			return false
+		}
+		return iframe.Function < jframe.Function
+	})
+}
+
+func (h *MockHandler) Write(to govulncheck.Handler) error {
+	h.Sort()
+	for _, config := range h.ConfigMessages {
+		if err := to.Config(config); err != nil {
+			return err
+		}
+	}
+	for _, progress := range h.ProgressMessages {
+		if err := to.Progress(progress); err != nil {
+			return err
+		}
+	}
+	seen := map[string]bool{}
+	for _, finding := range h.FindingMessages {
+		if !seen[finding.OSV] {
+			seen[finding.OSV] = true
+			// first time seeing this osv, so find and write the osv message
+			for _, osv := range h.OSVMessages {
+				if osv.ID == finding.OSV {
+					if err := to.OSV(osv); err != nil {
+						return err
+					}
+				}
+			}
+		}
+		if err := to.Finding(finding); err != nil {
+			return err
+		}
+	}
+	for _, osv := range h.OSVMessages {
+		if !seen[osv.ID] {
+			if err := to.OSV(osv); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}

go/pkg/mod/golang.org/x/vuln@v1.0.4/internal/test/packages.go

@@ -0,0 +1,39 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package test
+
+import (
+	"os/exec"
+	"strings"
+	"testing"
+
+	"golang.org/x/tools/go/packages"
+)
+
+func VerifyImports(t *testing.T, allowed ...string) {
+	if _, err := exec.LookPath("go"); err != nil {
+		t.Skipf("skipping: %v", err)
+	}
+	cfg := &packages.Config{Mode: packages.NeedImports | packages.NeedDeps}
+	pkgs, err := packages.Load(cfg, ".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	check := map[string]struct{}{}
+	for _, imp := range allowed {
+		check[imp] = struct{}{}
+	}
+	for _, p := range pkgs {
+		for _, imp := range p.Imports {
+			// this is an approximate stdlib check that is good enough for these tests
+			if !strings.ContainsRune(imp.ID, '.') {
+				continue
+			}
+			if _, ok := check[imp.ID]; !ok {
+				t.Errorf("include of %s is not allowed", imp.ID)
+			}
+		}
+	}
+}

go/pkg/mod/golang.org/x/vuln@v1.0.4/internal/test/testenv.go

@@ -0,0 +1,20 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package test
+
+import (
+	"os/exec"
+	"testing"
+)
+
+// NeedsGoEnv skips t if the current system can't get the environment with
+// “go env” in a subprocess.
+func NeedsGoEnv(t testing.TB) {
+	t.Helper()
+
+	if _, err := exec.LookPath("go"); err != nil {
+		t.Skip("skipping test: can't run go env")
+	}
+}