core/lint
8
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity Actions

Fail closed on malformed govulncheck output

Browse source
This commit is contained in:
Snider 2026-04-16 06:49:40 +01:00
parent 6756f06e9a
commit fb307db690
3 changed files with 3 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.core/TODO.md
View file

@ -1 +0,0 @@
- @bug pkg/lint/vulncheck.go:113 — govulncheck JSON parsing silently skips malformed lines, so bad tool output can still look like a clean pass.

2
pkg/lint/vulncheck.go
View file

@ -111,7 +111,7 @@ func ParseVulnCheckJSON(stdout, stderr string) (*VulnResult, error) {
var msg govulncheckMessage
if err := json.Unmarshal([]byte(line), &msg); err != nil {
continue
return nil, coreerr.E("ParseVulnCheckJSON", "invalid govulncheck JSON output", err)
}
if msg.Config != nil {

7
pkg/lint/vulncheck_test.go
View file

@ -43,11 +43,8 @@ also not json
{"finding":{"osv":"GO-2024-5678","trace":[{"package":"example.com/dep","function":"Fn"}]}}
`
result, err := ParseVulnCheckJSON(stdout, "")
require.NoError(t, err)
assert.Equal(t, "example.com/app", result.Module)
require.Len(t, result.Findings, 1)
assert.Equal(t, "GO-2024-5678", result.Findings[0].ID)
assert.Equal(t, "Test vuln", result.Findings[0].Description)
require.Error(t, err)
assert.Nil(t, result)
}
func TestParseVulnCheckJSON_Empty(t *testing.T) {