3 ms·

i read somewhere go has a great package for this that checks statically typed usage of the vuln specific functions not whole package deps

• yencabulator 1y ago
  https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
  • tough 1y ago
    ty ty exactly what I was thinking does something like this exist for other languages like rust, python or js?
    • yencabulator 1y ago
      I don't think the Rust ecosystem has that at this time. They're annotating the vulnerabilities with affected functions, but as far as I know nobody's written the static analysis side of it. https://github.com/rustsec/rustsec/issues/21 https://github.com/rustsec/rustsec/issues/21 Python and JS might be so dynamic that such static analysis just isn't as useful.
    • dwattttt 1y ago
      For Rust, the advisory database cargo-audit uses (https://github.com/RustSec/advisory-db/ https://github.com/RustSec/advisory-db/) does track which functions are affected by a cve (if provided). I'm not sure if the tool uses them though.