x/vuln: vulnerabilities missing (go-reform analysis result)

[realchs]

Go version

go version go1.22.5 darwin/arm64

What did you do? Run govulncheck for (go-reform/reform v1.5.1):

govulncheck ./...

=== Symbol Results ===

Vulnerability #1: GO-2024-3107
    Stack exhaustion in Parse in go/build/constraint
  More info: https://pkg.go.dev/vuln/GO-2024-3107
  Standard library
    Found in: go/build/[email protected]
    Fixed in: go/build/[email protected]
    Example traces found:
      #1: reform/main.go:166:28: reform.main calls build.Import, which eventually calls constraint.Parse

Vulnerability #2: GO-2024-3105
    Stack exhaustion in all Parse functions in go/parser
  More info: https://pkg.go.dev/vuln/GO-2024-3105
  Standard library
    Found in: go/[email protected]
    Fixed in: go/[email protected]
    Example traces found:
      #1: parse/file.go:127:35: parse.File calls parser.ParseFile

Vulnerability #3: GO-2021-0113
    Out-of-bounds read in golang.org/x/text/language
  More info: https://pkg.go.dev/vuln/GO-2021-0113
  Module: golang.org/x/text
    Found in: golang.org/x/[email protected]
    Fixed in: golang.org/x/[email protected]
    Example traces found:
      #1: reform-db/main.go:15:2: reform.init calls stdlib.init, which eventually calls language.MustParse

Your code is affected by 3 vulnerabilities from 1 module and the Go standard library.
This scan also found 2 vulnerabilities in packages you import and 9
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.

What did you expect to see?

reform uses "github.com/jackc/[email protected]+incompatible" as a direct dependency and it has two security vulnerabilities as shown in https://deps.dev/go/gopkg.in%2Fjackc%2Fpgx.v3/v3.6.2.
However, the vulnerabilities are not found in the report of govulncheck.

[timothy-king]

CC @zpavlinovic, @golang/vulndb .

[gopherbot]

Change https://go.dev/cl/612875 mentions this issue: data/reports: update GO-2024-2606

[gopherbot]

Change https://go.dev/cl/612856 mentions this issue: data/reports: update GO-2024-2605

[zpavlinovic]

We were missing that pgx was also vulnerable before pgx/v4 . This should be addressed now:

=== Symbol Results ===

...

Vulnerability #4: GO-2024-2606
    SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx
  More info: https://pkg.go.dev/vuln/GO-2024-2606
  Module: github.com/jackc/pgx
    Found in: github.com/jackc/[email protected]+incompatible
    Fixed in: N/A
    Example traces found:
      #1: querier_selects.go:18:19: reform.Querier.NextRow calls sql.Rows.Next, which eventually calls sanitize.SanitizeSQL

Vulnerability #5: GO-2024-2605
    SQL injection in github.com/jackc/pgx/v4
  More info: https://pkg.go.dev/vuln/GO-2024-2605
  Module: github.com/jackc/pgx
    Found in: github.com/jackc/[email protected]+incompatible
    Fixed in: N/A
    Example traces found:
      #1: querier_selects.go:18:19: reform.Querier.NextRow calls sql.Rows.Next, which eventually calls sanitize.SanitizeSQL

...

You don't need to update the govulncheck version. We were missing this information in the vulnerability database.

Could you confim that you now see the expected results?

[realchs]

I've tested again and yes it worked as expected 👍