2 ms·
I think a big part of the push is just being able to easily & conclusively answer "are we vulnerable or not" when a new attack is discovered. Exhaustive invento
by yencabulator 1y ago
I think a big part of the push is just being able to easily & conclusively answer "are we vulnerable or not" when a new attack is discovered. Exhaustive inventory already is huge.
- tough 1y agoi read somewhere go has a great package for this that checks statically typed usage of the vuln specific functions not whole package deps
- yencabulator 1y agohttps://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
- tough 1y agoty ty exactly what I was thinking does something like this exist for other languages like rust, python or js?
- yencabulator 1y agoI don't think the Rust ecosystem has that at this time. They're annotating the vulnerabilities with affected functions, but as far as I know nobody's written the static analysis side of it. https://github.com/rustsec/rustsec/issues/21 https://github.com/rustsec/rustsec/issues/21 Python and JS might be so dynamic that such static analysis just isn't as useful.
- dwattttt 1y agoFor Rust, the advisory database cargo-audit uses (https://github.com/RustSec/advisory-db/ https://github.com/RustSec/advisory-db/) does track which functions are affected by a cve (if provided). I'm not sure if the tool uses them though.