init vuncheck linter

Author: Florent Viel

go.mod

@@ -106,7 +106,8 @@ require (
 	github.com/yagipy/maintidx v1.0.0
 	github.com/yeya24/promlinter v0.2.0
 	gitlab.com/bosi/decorder v0.2.3
-	golang.org/x/tools v0.1.12
+	golang.org/x/tools v0.1.13-0.20220803210227-8b9a1fbdf5c3
+	golang.org/x/vuln v0.0.0-20220902211423-27dd78d2ca39
 	gopkg.in/yaml.v3 v3.0.1
 	honnef.co/go/tools v0.3.3
 	mvdan.cc/gofumpt v0.3.1
@@ -185,3 +186,5 @@ require (
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b // indirect
 )
+
+require golang.org/x/net v0.0.0-20220722155237-a158d28d115b

go.sum

@@ -199,6 +199,7 @@ type LintersSettings struct {
 	Whitespace       WhitespaceSettings
 	Wrapcheck        WrapcheckSettings
 	WSL              WSLSettings
+	Vulncheck        VulncheckSettings
 
 	Custom map[string]CustomLinterSettings
 }
@@ -672,6 +673,10 @@ type VarnamelenSettings struct {
 	IgnoreDecls        []string `mapstructure:"ignore-decls"`
 }
 
+type VulncheckSettings struct {
+	VulnDatabase []string `mapstructure:"vuln-database"`
+}
+
 type WhitespaceSettings struct {
 	MultiIf   bool `mapstructure:"multi-if"`
 	MultiFunc bool `mapstructure:"multi-func"`

pkg/config/linters_settings.go

@@ -0,0 +1,84 @@
+package golinters
+
+import (
+	"sync"
+
+	"golang.org/x/net/context"
+	"golang.org/x/tools/go/analysis"
+	"golang.org/x/vuln/client"
+	"golang.org/x/vuln/vulncheck"
+
+	"github.com/golangci/golangci-lint/pkg/config"
+	"github.com/golangci/golangci-lint/pkg/golinters/goanalysis"
+	"github.com/golangci/golangci-lint/pkg/lint/linter"
+	"github.com/golangci/golangci-lint/pkg/result"
+)
+
+const (
+	vulncheckName = "vulncheck"
+	vulncheckDoc  = "Package vulncheck detects uses of known vulnerabilities in Go programs."
+)
+
+func NewVulncheck(settings *config.VulncheckSettings) *goanalysis.Linter {
+	var mu sync.Mutex
+	var resIssues []goanalysis.Issue
+
+	var analyzer = &analysis.Analyzer{
+		Name: vulncheckName,
+		Doc:  vulncheckDoc,
+		Run:  goanalysis.DummyRun,
+	}
+
+	return goanalysis.NewLinter(
+		"vulncheck",
+		"Package vulncheck detects uses of known vulnerabilities in Go programs.",
+		[]*analysis.Analyzer{analyzer},
+		nil,
+	).WithContextSetter(func(lintCtx *linter.Context) {
+		analyzer.Run = func(pass *analysis.Pass) (interface{}, error) {
+			issues, err := vulncheckRun(lintCtx, pass, settings)
+
+			if err != nil {
+				return nil, err
+			}
+
+			mu.Lock()
+			resIssues = append(resIssues, issues...)
+			mu.Unlock()
+
+			return nil, nil
+		}
+	}).WithIssuesReporter(func(*linter.Context) []goanalysis.Issue {
+		return resIssues
+	})
+}
+
+func vulncheckRun(lintCtx *linter.Context, pass *analysis.Pass, settings *config.VulncheckSettings) ([]goanalysis.Issue, error) {
+	dbs := []string{"https://vuln.go.dev"}
+	if len(settings.VulnDatabase) > 0 {
+		dbs = settings.VulnDatabase
+	}
+	dbClient, err := client.NewClient(dbs, client.Options{})
+	if err != nil {
+		return nil, err
+	}
+
+	vcfg := &vulncheck.Config{Client: dbClient, SourceGoVersion: lintCtx.Cfg.Run.Go}
+	vpkgs := vulncheck.Convert(lintCtx.Packages)
+	ctx := context.Background()
+
+	r, err := vulncheck.Source(ctx, vpkgs, vcfg)
+	if err != nil {
+		return nil, err
+	}
+
+	issues := make([]goanalysis.Issue, len(r.Vulns))
+
+	for _, vuln := range r.Vulns {
+		issues = append(issues, goanalysis.NewIssue(&result.Issue{
+			Text: vuln.OSV.ID,
+		}, pass))
+	}
+
+	return issues, nil
+}

pkg/golinters/vulncheck.go

@@ -173,6 +173,7 @@ func (m Manager) GetAllSupportedLinterConfigs() []*linter.Config {
 		whitespaceCfg       *config.WhitespaceSettings
 		wrapcheckCfg        *config.WrapcheckSettings
 		wslCfg              *config.WSLSettings
+		vulncheckCfg        *config.VulncheckSettings
 	)
 
 	if m.cfg != nil {
@@ -247,6 +248,7 @@ func (m Manager) GetAllSupportedLinterConfigs() []*linter.Config {
 		whitespaceCfg = &m.cfg.LintersSettings.Whitespace
 		wrapcheckCfg = &m.cfg.LintersSettings.Wrapcheck
 		wslCfg = &m.cfg.LintersSettings.WSL
+		vulncheckCfg = &m.cfg.LintersSettings.Vulncheck
 
 		if govetCfg != nil {
 			govetCfg.Go = m.cfg.Run.Go
@@ -846,6 +848,11 @@ func (m Manager) GetAllSupportedLinterConfigs() []*linter.Config {
 			WithSince("v1.26.0").
 			WithPresets(linter.PresetStyle).
 			WithURL("https://github.com/golangci/golangci-lint/blob/master/pkg/golinters/nolintlint/README.md"),
+
+		linter.NewConfig(golinters.NewVulncheck(vulncheckCfg)).
+			WithSince("v1.49.0").
+			WithPresets(linter.PresetModule).
+			WithURL("https://vuln.go.dev/"),
 	}
 
 	enabledByDefault := map[string]bool{