[wip] add vulncheck as linter

.golangci.reference.yml

@@ -1964,6 +1964,9 @@ linters-settings:
       - T any
       - m map[string]int
 
+  vulncheck:
+    vuln-database: [https://vuln.go.dev]
+
   whitespace:
     # Enforces newlines (or comments) after every multi-line if statement.
     # Default: false
@@ -2180,6 +2183,7 @@ linters:
     - usestdlibvars
     - varcheck
     - varnamelen
+    - vulncheck
     - wastedassign
     - whitespace
     - wrapcheck
@@ -2294,6 +2298,7 @@ linters:
     - usestdlibvars
     - varcheck
     - varnamelen
+    - vulncheck
     - wastedassign
     - whitespace
     - wrapcheck

go.mod

@@ -117,12 +117,14 @@ require (
 	gitlab.com/bosi/decorder v0.2.3
 	go.tmz.dev/musttag v0.7.1
 	golang.org/x/exp v0.0.0-20230510235704-dd950f8aeaea
+	golang.org/x/net v0.11.0
 	golang.org/x/tools v0.10.0
+	golang.org/x/vuln v0.2.0
 	gopkg.in/yaml.v3 v3.0.1
 	honnef.co/go/tools v0.4.3
 	mvdan.cc/gofumpt v0.5.0
 	mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed
-	mvdan.cc/unparam v0.0.0-20221223090309-7455f1af531d
+	mvdan.cc/unparam v0.0.0-20230312165513-e84e2d14e3b8
 )
 
 require (
@@ -188,7 +190,7 @@ require (
 	golang.org/x/mod v0.11.0 // indirect
 	golang.org/x/sync v0.3.0 // indirect
 	golang.org/x/sys v0.9.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/text v0.10.0 // indirect
 	google.golang.org/protobuf v1.28.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect

pkg/config/linters_settings.go

@@ -224,6 +224,7 @@ type LintersSettings struct {
 	UseStdlibVars    UseStdlibVarsSettings
 	Varcheck         VarCheckSettings
 	Varnamelen       VarnamelenSettings
+	Vulncheck        VulncheckSettings
 	Whitespace       WhitespaceSettings
 	Wrapcheck        WrapcheckSettings
 	WSL              WSLSettings
@@ -786,6 +787,10 @@ type VarnamelenSettings struct {
 	IgnoreDecls        []string `mapstructure:"ignore-decls"`
 }
 
+type VulncheckSettings struct {
+	VulnDatabase []string `mapstructure:"vuln-database"`
+}
+
 type WhitespaceSettings struct {
 	MultiIf   bool `mapstructure:"multi-if"`
 	MultiFunc bool `mapstructure:"multi-func"`

pkg/golinters/vulncheck.go

@@ -0,0 +1,85 @@
+package golinters
+
+import (
+	"bytes"
+	"path/filepath"
+	"sync"
+
+	"golang.org/x/net/context"
+	"golang.org/x/tools/go/analysis"
+	"golang.org/x/vuln/scan"
+
+	"github.com/golangci/golangci-lint/pkg/config"
+	"github.com/golangci/golangci-lint/pkg/golinters/goanalysis"
+	"github.com/golangci/golangci-lint/pkg/lint/linter"
+	"github.com/golangci/golangci-lint/pkg/result"
+)
+
+const (
+	vulncheckName = "vulncheck"
+	vulncheckDoc  = "vulncheck detects uses of known vulnerabilities in Go programs."
+)
+
+func NewVulncheck(settings *config.VulncheckSettings) *goanalysis.Linter {
+	var mu sync.Mutex
+	var resIssues []goanalysis.Issue
+
+	analyzer := &analysis.Analyzer{
+		Name: vulncheckName,
+		Doc:  vulncheckDoc,
+		Run:  goanalysis.DummyRun,
+	}
+
+	return goanalysis.NewLinter(
+		vulncheckName,
+		vulncheckDoc,
+		[]*analysis.Analyzer{analyzer},
+		nil,
+	).WithContextSetter(func(lintCtx *linter.Context) {
+		analyzer.Run = func(pass *analysis.Pass) (any, error) {
+			issues, err := vulncheckRun(lintCtx, pass, settings)
+			if err != nil {
+				return nil, err
+			}
+
+			mu.Lock()
+			resIssues = append(resIssues, issues...)
+			mu.Unlock()
+
+			return nil, nil
+		}
+	}).WithIssuesReporter(func(*linter.Context) []goanalysis.Issue {
+		return resIssues
+	})
+}
+
+func vulncheckRun(lintCtx *linter.Context, pass *analysis.Pass, _ *config.VulncheckSettings) ([]goanalysis.Issue, error) {
+	files := getFileNames(pass)
+
+	ctx := context.Background()
+	lintCtx.Log.Errorf("%v\n", files)
+
+	issues := []goanalysis.Issue{}
+	for _, file := range files {
+		lintCtx.Log.Errorf("%s %s %s %s\n", "-json", "-C", filepath.Dir(file), ".")
+		cmd := scan.Command(ctx, "-json", "-C", filepath.Dir(file), ".")
+		buf := &bytes.Buffer{}
+		cmd.Stderr = buf
+		cmd.Stdout = buf
+		err := cmd.Start()
+		if err != nil {
+			return issues, err
+		}
+		err = cmd.Wait()
+		if err != nil {
+			return issues, err
+		}
+		issues = append(issues, goanalysis.NewIssue(&result.Issue{
+			Text:       buf.String(),
+			FromLinter: vulncheckName},
+			pass))
+	}
+
+	lintCtx.Log.Errorf("%v\n", issues)
+	return issues, nil
+}

pkg/lint/lintersdb/manager.go

@@ -138,6 +138,7 @@ func (m Manager) GetAllSupportedLinterConfigs() []*linter.Config {
 		usestdlibvars       *config.UseStdlibVarsSettings
 		varcheckCfg         *config.VarCheckSettings
 		varnamelenCfg       *config.VarnamelenSettings
+		vulncheckCfg        *config.VulncheckSettings
 		whitespaceCfg       *config.WhitespaceSettings
 		wrapcheckCfg        *config.WrapcheckSettings
 		wslCfg              *config.WSLSettings
@@ -218,6 +219,7 @@ func (m Manager) GetAllSupportedLinterConfigs() []*linter.Config {
 		usestdlibvars = &m.cfg.LintersSettings.UseStdlibVars
 		varcheckCfg = &m.cfg.LintersSettings.Varcheck
 		varnamelenCfg = &m.cfg.LintersSettings.Varnamelen
+		vulncheckCfg = &m.cfg.LintersSettings.Vulncheck
 		whitespaceCfg = &m.cfg.LintersSettings.Whitespace
 		wrapcheckCfg = &m.cfg.LintersSettings.Wrapcheck
 		wslCfg = &m.cfg.LintersSettings.WSL
@@ -851,6 +853,11 @@ func (m Manager) GetAllSupportedLinterConfigs() []*linter.Config {
 			WithLoadForGoAnalysis().
 			WithURL("https://github.com/blizzy78/varnamelen"),
 
+		linter.NewConfig(golinters.NewVulncheck(vulncheckCfg)).
+			WithSince("v1.53.0").
+			WithPresets(linter.PresetModule).
+			WithURL("https://vuln.go.dev/"),
+
 		linter.NewConfig(golinters.NewWastedAssign()).
 			WithSince("v1.38.0").
 			WithPresets(linter.PresetStyle).

test/linters_test.go

@@ -32,6 +32,7 @@ func TestSourcesFromTestdataSubDir(t *testing.T) {
 		"loggercheck",
 		"ginkgolinter",
 		"zerologlint",
+		"vulncheck",
 	}
 
 	for _, dir := range subDirs {
@@ -68,6 +69,7 @@ func testSourcesFromDir(t *testing.T, dir string) {
 			rel, err := filepath.Rel(dir, source)
 			require.NoError(t, err)
 
+			log.Warnf("TESTING: [%v] [%v] [%v] [%v]", subTest, log, binPath, rel)
 			testOneSource(subTest, log, binPath, rel)
 		})
 	}

test/testdata/vulncheck/go.mod

@@ -0,0 +1,5 @@
+module vulncheck
+
+go 1.19
+
+require golang.org/x/text v0.3.7

test/testdata/vulncheck/vulncheck.go

@@ -0,0 +1,13 @@
+//golangcitest:args --disable-all -Evulncheck .
+package vulncheck
+
+import (
+	"fmt"
+
+	"golang.org/x/text/language"
+)
+
+func ParseRegion() {
+	us := language.MustParseRegion("US")
+	fmt.Println(us)
+}