fix(vulnfeeds): validate the entire URL, not the repo part #2836
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit adjusts link validation, so that it validates the *entire* link *before* separating it into a repo and commit. Previously, the repo just URL was validated. This was allowing GitHub commit URLs that were 404'ing to escape detection, which was not the intention. This was discovered while investigating analysis failures for records that had valid-looking GitHub commit ranges.
oliverchang
approved these changes
Nov 6, 2024
This commit fixes `cves.Commit()` so it still correctly supports canoncalized git.kernel.org URLs. The canoncalization removes the `/cgit` hint from the path. Also add the start of some test coverage for `cves.Commit()`
andrewpollock
added a commit
to andrewpollock/osv.dev
that referenced
this pull request
Nov 8, 2024
This commit addresses the performance regression introduced in google#2836 by only making a remote network request for URLs that have passed initial muster as being appropriately shaped.
andrewpollock
added a commit
that referenced
this pull request
Nov 8, 2024
This commit addresses the performance regression introduced in #2836 by only making a remote network request for URLs that have passed initial muster as being appropriately shaped. (#2836 causes a significant blowout in runtime of a conversion run due to the aggregate latency of all the remote link checking)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit adjusts link validation, so that it validates the entire link before separating it into a repo and commit. Previously, just the repo URL was validated. This was allowing GitHub commit URLs that were 404'ing to escape detection, which was not the intention.
This was discovered while investigating analysis failures for records that had valid-looking GitHub commit ranges.