mirror of
https://github.com/anchore/syft.git
synced 2026-10-31 14:36:33 +01:00
Will Murphy
e38851143e
* chore: centralize temp files and prefer streaming IO Catalogers that create temp files ad-hoc can easily forget cleanup, leaking files on disk. Similarly, io.ReadAll is convenient but risks OOM on large or malicious inputs. Introduce internal/tmpdir to manage all cataloger temp storage under a single root directory with automatic cleanup. Prefer streaming parsers (bufio.Scanner, json/yaml.NewDecoder, io.LimitReader) over buffering entire inputs into memory. Add ruleguard rules to enforce both practices going forward. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: go back to old release parsing Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * simplify to limit reader in version check Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: regex change postponed Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * simplify supplement release to limitreader Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> --------- Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
52 lines
1.5 KiB
Go
52 lines
1.5 KiB
Go
package linux
|
|
|
|
import (
|
|
"io"
|
|
"regexp"
|
|
"strings"
|
|
|
|
"github.com/anchore/syft/internal"
|
|
"github.com/anchore/syft/internal/log"
|
|
"github.com/anchore/syft/syft/file"
|
|
)
|
|
|
|
func supplementDebianVersion(resolver file.Resolver, release *Release) {
|
|
// we're only looking for version information for debian when none is present in /etc/os-release
|
|
if release.Version != "" || release.VersionID != "" || !strings.EqualFold(release.ID, "debian") {
|
|
return
|
|
}
|
|
// if we have a debian release with no version, look for a debian_version
|
|
locations, err := resolver.FilesByGlob("/etc/debian_version")
|
|
if err != nil {
|
|
log.Debugf("error reading /etc/debian_version: %v", err)
|
|
return
|
|
}
|
|
for _, location := range locations {
|
|
version := readDebianVersionFile(resolver, location)
|
|
if version != "" {
|
|
release.Version = version
|
|
release.VersionID = version
|
|
return // keep the first result
|
|
}
|
|
}
|
|
}
|
|
|
|
func readDebianVersionFile(resolver file.Resolver, location file.Location) string {
|
|
rdr, err := resolver.FileContentsByLocation(location)
|
|
if err != nil {
|
|
log.Debugf("error getting contents for %s: %v", location.RealPath, err)
|
|
return ""
|
|
}
|
|
defer internal.CloseAndLogError(rdr, location.RealPath)
|
|
contents, err := io.ReadAll(io.LimitReader(rdr, 5*1024*1024))
|
|
if err != nil {
|
|
log.Debugf("error reading %s: %v", location.RealPath, err)
|
|
return ""
|
|
}
|
|
version := strings.TrimSpace(string(contents))
|
|
if regexp.MustCompile(`^\d+(?:\.\d+)?$`).MatchString(version) {
|
|
return version
|
|
}
|
|
return ""
|
|
}
|