From 2cdfbe3bb4d7b5da1244ca9918c34e35e187f206 Mon Sep 17 00:00:00 2001 From: Sinclair Date: Fri, 14 Apr 2023 14:46:31 +0900 Subject: [PATCH] fix: dependency graph using small query at once to avoid timeout (#1642) --- detector/github.go | 6 +++--- go.mod | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detector/github.go b/detector/github.go index 69903144..77251301 100644 --- a/detector/github.go +++ b/detector/github.go @@ -222,9 +222,9 @@ func DetectGitHubDependencyGraph(r *models.ScanResult, owner, repo, token string // recursive function func fetchDependencyGraph(r *models.ScanResult, httpClient *http.Client, owner, repo, after, dependenciesAfter string) (err error) { const queryFmt = `{"query": - "query { repository(owner:\"%s\", name:\"%s\") { url dependencyGraphManifests(first: %d, withDependencies: true%s) { pageInfo { endCursor hasNextPage } edges { node { blobPath filename repository { url } parseable exceedsMaxSize dependenciesCount dependencies%s { pageInfo { endCursor hasNextPage } edges { node { packageName packageManager repository { url } requirements hasDependencies } } } } } } } }"}` + "query { repository(owner:\"%s\", name:\"%s\") { url dependencyGraphManifests(first: %d, withDependencies: true%s) { pageInfo { endCursor hasNextPage } edges { node { blobPath filename repository { url } parseable exceedsMaxSize dependenciesCount dependencies(first: %d%s) { pageInfo { endCursor hasNextPage } edges { node { packageName packageManager repository { url } requirements hasDependencies } } } } } } } }"}` - queryStr := fmt.Sprintf(queryFmt, owner, repo, 100, after, dependenciesAfter) + queryStr := fmt.Sprintf(queryFmt, owner, repo, 50, after, 100, dependenciesAfter) ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute) req, err := http.NewRequestWithContext(ctx, http.MethodPost, "https://api.github.com/graphql", @@ -283,7 +283,7 @@ func fetchDependencyGraph(r *models.ScanResult, httpClient *http.Client, owner, r.GitHubManifests[m.Node.BlobPath] = manifest if m.Node.Dependencies.PageInfo.HasNextPage { - dependenciesAfter = fmt.Sprintf(`(after: \"%s\")`, m.Node.Dependencies.PageInfo.EndCursor) + dependenciesAfter = fmt.Sprintf(`, after: \"%s\"`, m.Node.Dependencies.PageInfo.EndCursor) } } if dependenciesAfter != "" { diff --git a/go.mod b/go.mod index 07fce3cf..43894e29 100644 --- a/go.mod +++ b/go.mod @@ -17,6 +17,7 @@ require ( github.com/d4l3k/messagediff v1.2.2-0.20190829033028-7e0a312ae40b github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21 github.com/emersion/go-smtp v0.14.0 + github.com/google/go-cmp v0.5.9 github.com/google/subcommands v1.2.0 github.com/google/uuid v1.3.0 github.com/gosnmp/gosnmp v1.35.0 @@ -98,7 +99,6 @@ require ( github.com/golang-jwt/jwt/v4 v4.2.0 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect github.com/golang/protobuf v1.5.2 // indirect - github.com/google/go-cmp v0.5.9 // indirect github.com/google/go-containerregistry v0.12.0 // indirect github.com/google/licenseclassifier/v2 v2.0.0-pre6 // indirect github.com/googleapis/enterprise-certificate-proxy v0.2.1 // indirect