Add golang.org/x/vuln/vulncheck as a linter

[joerdav]

trafficstars

Your feature request related to a problem? Please describe.

govulncheck allows you to check if your code is calling any vulnerable code.

Describe the solution you'd like.

Add https://pkg.go.dev/golang.org/x/vuln/vulncheck as a linter.

Describe alternatives you've considered.

I can't find another vulnerability checker that can determine if the vulnerable code is being called or not.

Additional context.

No response

[boring-cyborg[bot]]

Hey, thank you for opening your first Issue ! 🙂 If you would like to contribute we have a guide for contributors.

[ldez]

Hello,

There are several problems:

• vulncheck doesn't use the go/analysis API
• vulncheck is not designed to be used as a library

https://golangci-lint.run/contributing/new-linters/#how-to-add-a-public-linter-to-golangci-lint https://github.com/golang/vuln/tree/master/cmd/govulncheck

So I will decline this proposal.

[luxifer]

Hi,

I think the issue should be re-opened because of https://go.dev/blog/vuln and the vulncheck library that's used by the command govulncheck. I can work on it

[ryancurrah]

Looks like they have a API now, I havent looked at it though.

To directly integrate vulnerability checking into other tools and processes, the vulncheck package exports govulncheck’s functionality as a Go API.

[Dentrax]

It seems mentioned PR is currently Draft, and since they have an API as Ryan mentioned above, we can re-open this one. @ldez Wdyt?

[ldez]

As vulncheck is based on SSA, I think the integration will not work but I will re-open.

[Dentrax]

Thanks!

@luxifer Is your PR final? If so, can you please remove draft tag?

[luxifer]

I need to rewrite the commit as it's with the wrong address. But yes, I need some feedback on my proposal because it's the first time I'm using go/analysis

[Dentrax]

I can help you on that if you add me as collaborator in your fork.

[acabarbaye]

Having this tool running as part of the linters will be extremely useful

[ldez]

I didn't really provide my opinion on this topic: I think that vulncheck is not a linter. It's a vulnerability/security tool and should be run as a standalone tool.

Also, as the "rules" of vulncheck are outside the configuration file, golangci-lint will ignore any "rule" changes because it's not a part of the information used to handle the cache. This will lead to the same kind of problems as ruleguard (a part of go-critic) #1999

As you can understand, for now, I disagree with the integration of vulncheck, but I'm not alone on this project, and I can change my mind over time, I will wait for feedback from other maintainers.

I'm not making any decision at this time.

[luxifer]

I understand your concerns about that. And the afct that the database is external make it difficult to integrate properly with caching. Anyway, if it's not integrated, it's not a big deal for me and it helped me better understand the internal structure of this project.

[luxifer]

Maybe we can close this issue as well?

[ldez]

yes I will close it, thank you @luxifer