Skip to content

Commit 98d17e3

Browse files
paulrosca-snykpaulrosca-snyk
committed
fix: reachability rendering
1 parent bc8dd7a commit 98d17e3

File tree

12 files changed

+80
-26
lines changed

12 files changed

+80
-26
lines changed

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ require (
2222
github.com/stretchr/testify v1.10.0
2323
golang.org/x/net v0.43.0
2424
golang.org/x/sync v0.17.0
25+
golang.org/x/text v0.29.0
26+
gopkg.in/yaml.v3 v3.0.1
2527
)
2628

2729
require (
@@ -100,10 +102,8 @@ require (
100102
golang.org/x/crypto v0.42.0 // indirect
101103
golang.org/x/oauth2 v0.27.0 // indirect
102104
golang.org/x/sys v0.36.0 // indirect
103-
golang.org/x/text v0.29.0 // indirect
104105
google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
105106
gopkg.in/warnings.v0 v0.1.2 // indirect
106-
gopkg.in/yaml.v3 v3.0.1 // indirect
107107
)
108108

109109
// replace github.com/snyk/go-application-framework => ../go-application-framework

‎internal/commands/ostest/__snapshots__/sbom_reachability_flow_test.snap‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
"projectName": "",
2828
"remediation": {
2929
"ignore": null,
30-
"patch": null,
3130
"pin": {},
3231
"unresolved": [],
3332
"upgrade": {
@@ -65,7 +64,7 @@
6564
"packageManager": "npm",
6665
"packageName": "foo",
6766
"publicationTime": "2025-07-28T17:11:43.000000Z",
68-
"reachability": "REACHABLE",
67+
"reachability": "reachable",
6968
"riskScore": 80,
7069
"severity": "high",
7170
"socialTrendAlert": false,

‎internal/legacy/definitions/legacy-json.tsp‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,19 @@ enum VulnerabilitySeverity {
1717
}
1818

1919
enum Reachability {
20-
REACHABLE,
21-
NOT_REACHABLE,
20+
reachable,
21+
`no-reachable-paths`,
22+
`not-applicable`,
23+
}
24+
25+
model ReachableFunctionPaths {
26+
functionName: string;
27+
callPaths: string[][];
28+
}
29+
30+
model ReachablePaths {
31+
pathCount: uint32;
32+
paths: ReachableFunctionPaths[];
2233
}
2334

2435
alias UpgradePath = string | boolean;
@@ -75,6 +86,7 @@ model Vulnerability {
7586
riskScore?: uint16;
7687
from: string[];
7788
reachability?: Reachability;
89+
reachablePaths?: ReachablePaths;
7890
upgradePath: UpgradePath[];
7991
isUpgradable: boolean;
8092
isPatchable: boolean;

‎internal/legacy/definitions/oapi.gen.go‎

Lines changed: 16 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎internal/legacy/definitions/spec.yaml‎

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -334,8 +334,36 @@ components:
334334
Reachability:
335335
type: string
336336
enum:
337-
- REACHABLE
338-
- NOT_REACHABLE
337+
- reachable
338+
- no-reachable-paths
339+
- not-applicable
340+
ReachableFunctionPaths:
341+
type: object
342+
required:
343+
- functionName
344+
- callPaths
345+
properties:
346+
functionName:
347+
type: string
348+
callPaths:
349+
type: array
350+
items:
351+
type: array
352+
items:
353+
type: string
354+
ReachablePaths:
355+
type: object
356+
required:
357+
- pathCount
358+
- paths
359+
properties:
360+
pathCount:
361+
type: integer
362+
format: uint32
363+
paths:
364+
type: array
365+
items:
366+
$ref: '#/components/schemas/ReachableFunctionPaths'
339367
Reference:
340368
type: object
341369
required:
@@ -350,7 +378,6 @@ components:
350378
type: object
351379
required:
352380
- ignore
353-
- patch
354381
- pin
355382
- unresolved
356383
- upgrade
@@ -359,10 +386,6 @@ components:
359386
type: object
360387
additionalProperties:
361388
type: string
362-
patch:
363-
type: object
364-
additionalProperties:
365-
type: string
366389
pin:
367390
type: object
368391
additionalProperties:
@@ -492,6 +515,8 @@ components:
492515
type: string
493516
reachability:
494517
$ref: '#/components/schemas/Reachability'
518+
reachablePaths:
519+
$ref: '#/components/schemas/ReachablePaths'
495520
upgradePath:
496521
type: array
497522
items:

‎internal/legacy/transform/__snapshots__/TestFindingToLegacyVulns_MultipleInstructions_1.snap‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@
4343
Proprietary: (*bool)(nil),
4444
PublicationTime: &"2025-01-01T12:00:00.000000Z",
4545
Reachability: (*definitions.Reachability)(nil),
46+
ReachablePaths: (*definitions.ReachablePaths)(nil),
4647
References: (*[]definitions.Reference)(nil),
4748
RiskScore: (*uint16)(nil),
4849
Semver: &definitions.SemVerInfo{

‎internal/legacy/transform/__snapshots__/TestFindingToLegacyVulns_NoInstructions_1.snap‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@
4040
Proprietary: (*bool)(nil),
4141
PublicationTime: &"2025-01-01T12:00:00.000000Z",
4242
Reachability: (*definitions.Reachability)(nil),
43+
ReachablePaths: (*definitions.ReachablePaths)(nil),
4344
References: (*[]definitions.Reference)(nil),
4445
RiskScore: (*uint16)(nil),
4546
Semver: &definitions.SemVerInfo{

‎internal/legacy/transform/__snapshots__/TestFindingToLegacyVulns_SingleInstruction_1.snap‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
Proprietary: (*bool)(nil),
4343
PublicationTime: &"2025-01-01T12:00:00.000000Z",
4444
Reachability: (*definitions.Reachability)(nil),
45+
ReachablePaths: (*definitions.ReachablePaths)(nil),
4546
References: (*[]definitions.Reference)(nil),
4647
RiskScore: (*uint16)(nil),
4748
Semver: &definitions.SemVerInfo{

‎internal/legacy/transform/remediation_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ func Test_RemediationSummaryToLegacy(t *testing.T) {
209209
PackageName: util.Ptr("baz"),
210210
Version: "1.0.0",
211211
IsUpgradable: false,
212-
Reachability: util.Ptr(definitions.REACHABLE),
212+
Reachability: util.Ptr(definitions.Reachable),
213213
CvssScore: util.Ptr(float32(9.7)),
214214
Severity: definitions.Critical,
215215
ModificationTime: util.Ptr("2025-06-03T10:14:39Z"),
@@ -270,7 +270,7 @@ func Test_RemediationSummaryToLegacy(t *testing.T) {
270270
PackageName: util.Ptr("baz"),
271271
Version: "1.0.0",
272272
IsUpgradable: false,
273-
Reachability: util.Ptr(definitions.REACHABLE),
273+
Reachability: util.Ptr(definitions.Reachable),
274274
CvssScore: util.Ptr(float32(9.7)),
275275
Severity: definitions.Critical,
276276
ModificationTime: util.Ptr("2025-06-03T10:14:39Z"),
@@ -284,7 +284,7 @@ func Test_RemediationSummaryToLegacy(t *testing.T) {
284284
PackageName: util.Ptr("foo"),
285285
Version: "1.0.0",
286286
IsUpgradable: true,
287-
Reachability: util.Ptr(definitions.REACHABLE),
287+
Reachability: util.Ptr(definitions.Reachable),
288288
CvssScore: util.Ptr(float32(7.7)),
289289
Severity: definitions.High,
290290
ModificationTime: util.Ptr("2025-06-03T10:14:39Z"),

‎internal/legacy/transform/transform.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -311,10 +311,12 @@ func ProcessEvidenceForFinding(vuln *definitions.Vulnerability, ev *testapi.Evid
311311
}
312312
switch reachEvidence.Reachability {
313313
case testapi.ReachabilityTypeFunction:
314-
vuln.Reachability = util.Ptr(definitions.REACHABLE)
314+
vuln.Reachability = util.Ptr(definitions.Reachable)
315315
case testapi.ReachabilityTypeNoInfo:
316-
vuln.Reachability = util.Ptr(definitions.NOTREACHABLE)
317-
case testapi.ReachabilityTypeNotApplicable, testapi.ReachabilityTypeNone:
316+
vuln.Reachability = util.Ptr(definitions.NoReachablePaths)
317+
case testapi.ReachabilityTypeNotApplicable:
318+
vuln.Reachability = util.Ptr(definitions.NotApplicable)
319+
default:
318320
// No reachability value set for these types
319321
}
320322
}

0 commit comments

Comments
 (0)