mirror of
https://github.com/anchore/syft.git
synced 2026-10-30 22:12:28 +01:00
Will Murphy
e38851143e
* chore: centralize temp files and prefer streaming IO Catalogers that create temp files ad-hoc can easily forget cleanup, leaking files on disk. Similarly, io.ReadAll is convenient but risks OOM on large or malicious inputs. Introduce internal/tmpdir to manage all cataloger temp storage under a single root directory with automatic cleanup. Prefer streaming parsers (bufio.Scanner, json/yaml.NewDecoder, io.LimitReader) over buffering entire inputs into memory. Add ruleguard rules to enforce both practices going forward. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: go back to old release parsing Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * simplify to limit reader in version check Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: regex change postponed Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * simplify supplement release to limitreader Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> --------- Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
52 lines
1.3 KiB
Go
52 lines
1.3 KiB
Go
package githubactions
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"go.yaml.in/yaml/v3"
|
|
|
|
"github.com/anchore/syft/internal/unknown"
|
|
"github.com/anchore/syft/syft/artifact"
|
|
"github.com/anchore/syft/syft/file"
|
|
"github.com/anchore/syft/syft/pkg"
|
|
"github.com/anchore/syft/syft/pkg/cataloger/generic"
|
|
)
|
|
|
|
var _ generic.Parser = parseCompositeActionForActionUsage
|
|
|
|
type compositeActionDef struct {
|
|
Runs compositeActionRunsDef `yaml:"runs"`
|
|
}
|
|
|
|
type compositeActionRunsDef struct {
|
|
Steps []stepDef `yaml:"steps"`
|
|
}
|
|
|
|
func parseCompositeActionForActionUsage(_ context.Context, _ file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
|
|
var ca compositeActionDef
|
|
var errs error
|
|
if errs = yaml.NewDecoder(reader).Decode(&ca); errs != nil {
|
|
return nil, nil, fmt.Errorf("unable to parse yaml composite action file: %w", errs)
|
|
}
|
|
|
|
// we use a collection to help with deduplication before raising to higher level processing
|
|
pkgs := pkg.NewCollection()
|
|
|
|
for _, step := range ca.Runs.Steps {
|
|
if step.Uses == "" {
|
|
continue
|
|
}
|
|
|
|
p, err := newPackageFromUsageStatement(step.Uses, step.UsesComment, reader.Location)
|
|
if err != nil {
|
|
errs = unknown.Append(errs, reader, err)
|
|
}
|
|
if p != nil {
|
|
pkgs.Add(*p)
|
|
}
|
|
}
|
|
|
|
return pkgs.Sorted(), nil, errs
|
|
}
|