fix: cleanup

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

Author: spiffcs

cmd/grype/cli/commands/internal/dbsearch/versions.go

@@ -2,7 +2,7 @@ package dbsearch
 
 const (
 	// MatchesSchemaVersion is the schema version for the `db search` command
-	MatchesSchemaVersion = "1.1.6"
+	MatchesSchemaVersion = "1.1.7"
 
 	// MatchesSchemaVersion Changelog:
 	// 1.0.0 - Initial schema 🎉
@@ -16,6 +16,7 @@ const (
 	// 1.1.4 - Add rpm_arch field to PackageQualifiers (source/binary tagging for the CSAF VEX transformer)
 	// 1.1.5 - Add rootio field to PackageQualifiers (for Root IO NAK-pattern matching via the OSV rootio strategy)
 	// 1.1.6 - Rename rpm_arch field on PackageQualifiers to architecture (semantics unchanged; rpm-specific prefix dropped)
+	// 1.1.7 - Add go_imports field to PackageQualifiers (per-symbol reachability from govulndb ecosystem_specific.imports, used for Go binary symbol matching via the gosymbols qualifier)
 
 	// VulnerabilitiesSchemaVersion is the schema version for the `db search vuln` command
 	VulnerabilitiesSchemaVersion = "1.0.5"

grype/db/v6/build/transformers/osv/transform_go_vuln_db.go

@@ -1,7 +1,6 @@
 package osv
 
 import (
-	"encoding/json"
 	"fmt"
 	"sort"
 	"strings"
@@ -126,7 +125,7 @@ func govulndbAffectedPackages(vuln unmarshal.OSVVulnerability) []db.AffectedPack
 			continue
 		}
 		var qualifiers *db.PackageQualifiers
-		if imports := govulndbImports(affected); len(imports) > 0 {
+		if imports := govulndbImports(affected, vuln.ID); len(imports) > 0 {
 			qualifiers = &db.PackageQualifiers{GoImports: imports}
 		}
 		aphs = append(aphs, db.AffectedPackageHandle{
@@ -320,20 +319,25 @@ func govulndbCustomRanges(affected osvmodel.Affected, id string) []osvmodel.Rang
 
 // govulndbImports extracts the affected package import paths and vulnerable symbols from the
 // OSV `ecosystem_specific.imports` field (see https://go.dev/security/vuln/database#schema).
-func govulndbImports(affected osvmodel.Affected) []db.GoImport {
+// Returns nil if absent or undecodable (logged), so malformed imports degrade to module-
+// granularity matching instead of erroring.
+func govulndbImports(affected osvmodel.Affected, id string) []db.GoImport {
 	raw, ok := affected.EcosystemSpecific["imports"]
 	if !ok {
 		return nil
 	}
 
-	// the ecosystem_specific field is unmarshalled as a generic map, so round-trip through JSON
-	// to get the typed shape
-	encoded, err := json.Marshal(raw)
+	var imports []db.GoImport
+	decoder, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
+		Result:  &imports,
+		TagName: "json",
+	})
 	if err != nil {
 		return nil
 	}
-	var imports []db.GoImport
-	if err := json.Unmarshal(encoded, &imports); err != nil {
+	if err := decoder.Decode(raw); err != nil {
+		log.WithFields("id", id, "package", affected.Package.Name, "error", err).
+			Warn("unable to decode govulndb imports; matching at module granularity")
 		return nil
 	}
 	return imports

grype/db/v6/db.go

@@ -24,7 +24,7 @@ const (
 	Revision = 1
 
 	// Addition indicates how many changes have been introduced that are compatible with all historical data
-	Addition = 7
+	Addition = 8
 
 	// v6 model changelog:
 	// 6.0.0: Initial version 🎉
@@ -48,6 +48,11 @@ const (
 	//        architecture). The field's semantics are unchanged; the rename drops the rpm-
 	//        specific prefix because the value already lives in PackageQualifiers and can
 	//        carry any architecture string for future arch-scoped advisories.
+	// 6.1.8: Add GoImports field to PackageQualifiers (used by the govulndb OSV strategy to
+	//        carry per-symbol reachability from ecosystem_specific.imports; the gosymbols
+	//        runtime qualifier in pkg/qualifier/gosymbols matches captured Go binary symbols
+	//        so stdlib and golang.org/x/* advisories don't FP-match binaries that don't use
+	//        the vulnerable symbols)
 )
 
 const (

grype/db/v6/vulnerability_test.go

@@ -9,10 +9,53 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/anchore/grype/grype/pkg"
 	"github.com/anchore/grype/grype/version"
 	"github.com/anchore/grype/grype/vulnerability"
 )
 
+// Test_toPackageQualifiers_goImports verifies that a GoImports package qualifier, as it is stored in
+// the vulnerability DB (see the govulndb transformer), is converted into a working gosymbols qualifier
+// at load time. It uses the "stdlib" imports of GO-2022-0969 (net/http HTTP/2 server DoS) against
+// realistic captured Go binary symbols to confirm the DB data actually drives symbol-level matching.
+func Test_toPackageQualifiers_goImports(t *testing.T) {
+	// as emitted by the transformer from ecosystem_specific.imports
+	blob := &PackageQualifiers{
+		GoImports: []GoImport{{
+			Path: "net/http",
+			Symbols: []string{
+				"ListenAndServe", "ListenAndServeTLS", "Serve", "ServeTLS",
+				"Server.ListenAndServe", "Server.ListenAndServeTLS", "Server.Serve", "Server.ServeTLS",
+				"http2Server.ServeConn", "http2serverConn.goAway",
+			},
+		}},
+	}
+
+	qualifiers := toPackageQualifiers(blob)
+	require.Len(t, qualifiers, 1, "expected GoImports to produce a single gosymbols qualifier")
+
+	serverBinary := pkg.Package{
+		Name: "stdlib",
+		Metadata: pkg.GolangBinMetadata{
+			Symbols: []string{"net/http.ListenAndServe", "net/http.(*http2Server).ServeConn"},
+		},
+	}
+	clientBinary := pkg.Package{
+		Name: "stdlib",
+		Metadata: pkg.GolangBinMetadata{
+			Symbols: []string{"net/http.Get", "net/http.(*Client).Do"},
+		},
+	}
+
+	satisfied, err := qualifiers[0].Satisfied(serverBinary)
+	require.NoError(t, err)
+	assert.True(t, satisfied, "an http server binary should match the net/http server vuln")
+
+	satisfied, err = qualifiers[0].Satisfied(clientBinary)
+	require.NoError(t, err)
+	assert.False(t, satisfied, "an http client-only binary should not match the net/http server vuln")
+}
+
 func TestV5Namespace(t *testing.T) {
 	// provider input should be derived from the Providers table:
 	// +------------+---------+---------------+----------------------------------+------------------------+

grype/pkg/qualifier/gosymbols/qualifier.go

@@ -76,6 +76,13 @@ var typeParamPattern = regexp.MustCompile(`\[[^]]*]`)
 //   - the compiler's "-fm" method-value-wrapper suffix is removed: "pkg.(*T).M-fm" -> "pkg.T.M".
 //     A method-value wrapper is emitted when a method is referenced as a value (e.g. passed as a
 //     callback), so its presence means the underlying method is used.
+//
+// This is a best-effort textual heuristic, not a full demangler. The type-parameter stripping
+// assumes a single, non-nested bracket group; a nested instantiation like
+// "pkg.(*T[go.shape.[]int]).M" is not normalized cleanly. Such a symbol simply fails to match its
+// govulndb counterpart, so the failure mode is a missed match (false negative) for that one symbol
+// rather than a false positive — acceptable because generic vulnerable symbols with slice/nested
+// type arguments are vanishingly rare in govulndb advisories.
 func normalizeSymbol(symbol string) string {
 	symbol = strings.ReplaceAll(symbol, "(*", "")
 	symbol = strings.ReplaceAll(symbol, ")", "")

grype/pkg/qualifier/gosymbols/qualifier_test.go

@@ -28,6 +28,48 @@ func TestGoSymbolsQualifier_Satisfied(t *testing.T) {
 		Metadata: pkg.GolangBinMetadata{},
 	}
 
+	// stdlibHTTPServerVuln mirrors the ecosystem_specific.imports for the "stdlib" module in
+	// GO-2022-0969 (net/http HTTP/2 server DoS) as carried into the DB by the govulndb transformer.
+	// The listed symbols are all server-side entrypoints.
+	stdlibHTTPServerVuln := []Import{{
+		Path: "net/http",
+		Symbols: []string{
+			"ListenAndServe", "ListenAndServeTLS", "Serve", "ServeTLS",
+			"Server.ListenAndServe", "Server.ListenAndServeTLS", "Server.Serve", "Server.ServeTLS",
+			"http2Server.ServeConn", "http2serverConn.goAway",
+		},
+	}}
+
+	// stdlibServerPkg is a go binary that runs an HTTP server: its captured stdlib symbols include the
+	// vulnerable net/http server entrypoints. Symbol strings use syft's binary naming (import-path
+	// qualified, pointer-receiver decorated); the bundled HTTP/2 code appears under the http2* prefix.
+	stdlibServerPkg := pkg.Package{
+		Name: "stdlib",
+		Metadata: pkg.GolangBinMetadata{
+			Symbols: []string{
+				"net/http.ListenAndServe",
+				"net/http.(*Server).Serve",
+				"net/http.(*http2Server).ServeConn",
+				"net/http.(*Client).Do",
+			},
+		},
+	}
+
+	// stdlibClientPkg is a go binary that only makes HTTP *client* calls: it links net/http but none of
+	// the vulnerable server symbols, so it must not match the server-side DoS (the false-positive grype
+	// surfaced before symbol matching, when every net/http-linking binary matched the stdlib advisory).
+	stdlibClientPkg := pkg.Package{
+		Name: "stdlib",
+		Metadata: pkg.GolangBinMetadata{
+			Symbols: []string{
+				"net/http.Get",
+				"net/http.NewRequest",
+				"net/http.(*Client).Do",
+				"net/http.(*Transport).RoundTrip",
+			},
+		},
+	}
+
 	tests := []struct {
 		name      string
 		imports   []Import
@@ -103,6 +145,24 @@ func TestGoSymbolsQualifier_Satisfied(t *testing.T) {
 			pkg:       binaryPkg,
 			satisfied: true,
 		},
+		{
+			name:      "stdlib http server binary matches the net/http server vuln",
+			imports:   stdlibHTTPServerVuln,
+			pkg:       stdlibServerPkg,
+			satisfied: true,
+		},
+		{
+			name:      "stdlib bundled http2 server method matches (http2* prefix, pointer-receiver normalization)",
+			imports:   []Import{{Path: "net/http", Symbols: []string{"http2Server.ServeConn"}}},
+			pkg:       stdlibServerPkg,
+			satisfied: true,
+		},
+		{
+			name:      "stdlib http client-only binary does not match the net/http server vuln (no false positive)",
+			imports:   stdlibHTTPServerVuln,
+			pkg:       stdlibClientPkg,
+			satisfied: false,
+		},
 	}
 
 	for _, tt := range tests {
@@ -114,3 +174,52 @@ func TestGoSymbolsQualifier_Satisfied(t *testing.T) {
 		})
 	}
 }
+
+func Test_normalizeSymbol(t *testing.T) {
+	tests := []struct {
+		name   string
+		symbol string
+		want   string
+	}{
+		{
+			name:   "plain function is unchanged",
+			symbol: "golang.org/x/net/html.Parse",
+			want:   "golang.org/x/net/html.Parse",
+		},
+		{
+			name:   "value-receiver method is unchanged",
+			symbol: "net/http.Header.Get",
+			want:   "net/http.Header.Get",
+		},
+		{
+			name:   "pointer-receiver decoration is removed",
+			symbol: "net/http.(*Server).Serve",
+			want:   "net/http.Server.Serve",
+		},
+		{
+			name:   "generic instantiation loses its type parameters",
+			symbol: "golang.org/x/net/http2.(*Framer[go.shape.int]).ReadFrame",
+			want:   "golang.org/x/net/http2.Framer.ReadFrame",
+		},
+		{
+			name:   "method-value wrapper suffix is removed",
+			symbol: "golang.org/x/net/html.(*Tokenizer).readComment-fm",
+			want:   "golang.org/x/net/html.Tokenizer.readComment",
+		},
+		{
+			// known limitation: the type-parameter regex assumes a single, non-nested bracket
+			// group, so a nested instantiation is not normalized to "pkg.T.M". This pins the
+			// current (imperfect) behavior; the consequence is a missed match for that symbol,
+			// not a false positive. See normalizeSymbol's doc comment.
+			name:   "nested type parameter is not normalized cleanly (known limitation)",
+			symbol: "example.com/pkg.(*Cache[go.shape.[]int]).Get",
+			want:   "example.com/pkg.Cacheint].Get",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, normalizeSymbol(tt.symbol))
+		})
+	}
+}