breaking-change(go-cve-dict): support new go-cve-dictionary (#1277)

* feat(model): change CveContents(map[string]CveContent) to map[string][]CveContent

* fix(cpescan): use CveIDSource

* chore: check Nvd, Jvn data

* chore: go-cve-dictionary update

* chore: add to cveDetails as is, since CveID is embedded in the response

detector/cve_client.go

@@ -53,11 +53,7 @@ func (api goCveDictClient) fetchCveDetails(cveIDs []string) (cveDetails []cvemod
 		if err != nil {
 			return nil, xerrors.Errorf("Failed to fetch CVE. err: %w", err)
 		}
-		if len(cveDetail.CveID) == 0 {
-			cveDetails = append(cveDetails, cvemodels.CveDetail{CveID: cveID})
-		} else {
-			cveDetails = append(cveDetails, *cveDetail)
-		}
+		cveDetails = append(cveDetails, *cveDetail)
 	}
 	return
 }
@@ -103,13 +99,7 @@ func (api goCveDictClient) fetchCveDetailsViaHTTP(cveIDs []string) (cveDetails [
 	for range cveIDs {
 		select {
 		case res := <-resChan:
-			if len(res.CveDetail.CveID) == 0 {
-				cveDetails = append(cveDetails, cvemodels.CveDetail{
-					CveID: res.Key,
-				})
-			} else {
-				cveDetails = append(cveDetails, res.CveDetail)
-			}
+			cveDetails = append(cveDetails, res.CveDetail)
 		case err := <-errChan:
 			errs = append(errs, err)
 		case <-timeout:

detector/detector.go

@@ -284,8 +284,8 @@ func FillCvesWithNvdJvn(r *models.ScanResult, cnf config.GoCveDictConf, logOpts
 	}
 
 	for _, d := range ds {
-		nvd, exploits, mitigations := models.ConvertNvdJSONToModel(d.CveID, d.NvdJSON)
-		jvn := models.ConvertJvnToModel(d.CveID, d.Jvn)
+		nvds, exploits, mitigations := models.ConvertNvdToModel(d.CveID, d.Nvd)
+		jvns := models.ConvertJvnToModel(d.CveID, d.Jvn)
 
 		alerts := fillCertAlerts(&d)
 		for cveID, vinfo := range r.ScannedCves {
@@ -293,9 +293,9 @@ func FillCvesWithNvdJvn(r *models.ScanResult, cnf config.GoCveDictConf, logOpts
 				if vinfo.CveContents == nil {
 					vinfo.CveContents = models.CveContents{}
 				}
-				for _, con := range []*models.CveContent{nvd, jvn} {
-					if con != nil && !con.Empty() {
-						vinfo.CveContents[con.Type] = *con
+				for _, con := range append(nvds, jvns...) {
+					if !con.Empty() {
+						vinfo.CveContents[con.Type] = append(vinfo.CveContents[con.Type], con)
 					}
 				}
 				vinfo.AlertDict = alerts
@@ -310,8 +310,8 @@ func FillCvesWithNvdJvn(r *models.ScanResult, cnf config.GoCveDictConf, logOpts
 }
 
 func fillCertAlerts(cvedetail *cvemodels.CveDetail) (dict models.AlertDict) {
-	if cvedetail.NvdJSON != nil {
-		for _, cert := range cvedetail.NvdJSON.Certs {
+	for _, nvd := range cvedetail.Nvd {
+		for _, cert := range nvd.Certs {
 			dict.En = append(dict.En, models.Alert{
 				URL:   cert.Link,
 				Title: cert.Title,
@@ -319,8 +319,9 @@ func fillCertAlerts(cvedetail *cvemodels.CveDetail) (dict models.AlertDict) {
 			})
 		}
 	}
-	if cvedetail.Jvn != nil {
-		for _, cert := range cvedetail.Jvn.Certs {
+
+	for _, jvn := range cvedetail.Jvn {
+		for _, cert := range jvn.Certs {
 			dict.Ja = append(dict.Ja, models.Alert{
 				URL:   cert.Link,
 				Title: cert.Title,
@@ -328,6 +329,7 @@ func fillCertAlerts(cvedetail *cvemodels.CveDetail) (dict models.AlertDict) {
 			})
 		}
 	}
+
 	return dict
 }
 
@@ -422,8 +424,8 @@ func DetectCpeURIsCves(r *models.ScanResult, cpeURIs []string, cnf config.GoCveD
 
 		for _, detail := range details {
 			confidence := models.CpeVersionMatch
-			if detail.HasJvn() && !detail.HasNvd() {
-				// In the case of CpeVendorProduct-match, only the JVN is set(Nvd is not set).
+			if detail.CveIDSource == cvemodels.JvnType {
+				// In the case of CpeVendorProduct-match
 				confidence = models.CpeVendorProductMatch
 			}
 
@@ -450,11 +452,13 @@ func DetectCpeURIsCves(r *models.ScanResult, cpeURIs []string, cnf config.GoCveD
 func FillCweDict(r *models.ScanResult) {
 	uniqCweIDMap := map[string]bool{}
 	for _, vinfo := range r.ScannedCves {
-		for _, cont := range vinfo.CveContents {
-			for _, id := range cont.CweIDs {
-				if strings.HasPrefix(id, "CWE-") {
-					id = strings.TrimPrefix(id, "CWE-")
-					uniqCweIDMap[id] = true
+		for _, conts := range vinfo.CveContents {
+			for _, cont := range conts {
+				for _, id := range cont.CweIDs {
+					if strings.HasPrefix(id, "CWE-") {
+						id = strings.TrimPrefix(id, "CWE-")
+						uniqCweIDMap[id] = true
+					}
 				}
 			}
 		}

detector/github.go

@@ -125,7 +125,7 @@ func DetectGitHubSecurityAlerts(r *models.ScanResult, owner, repo, token string,
 
 				if val, ok := r.ScannedCves[cveID]; ok {
 					val.GitHubSecurityAlerts = val.GitHubSecurityAlerts.Add(m)
-					val.CveContents[models.GitHub] = cveContent
+					val.CveContents[models.GitHub] = append(val.CveContents[models.GitHub], cveContent)
 					r.ScannedCves[cveID] = val
 				} else {
 					v := models.VulnInfo{

detector/util.go

@@ -8,6 +8,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"reflect"
 	"regexp"
 	"sort"
 	"time"
@@ -196,30 +197,34 @@ func isCveInfoUpdated(cveID string, previous, current models.ScanResult) bool {
 		models.NewCveContentType(current.Family),
 	}
 
-	prevLastModified := map[models.CveContentType]time.Time{}
+	prevLastModified := map[models.CveContentType][]time.Time{}
 	preVinfo, ok := previous.ScannedCves[cveID]
 	if !ok {
 		return true
 	}
 	for _, cType := range cTypes {
-		if content, ok := preVinfo.CveContents[cType]; ok {
-			prevLastModified[cType] = content.LastModified
+		if conts, ok := preVinfo.CveContents[cType]; ok {
+			for _, cont := range conts {
+				prevLastModified[cType] = append(prevLastModified[cType], cont.LastModified)
+			}
 		}
 	}
 
-	curLastModified := map[models.CveContentType]time.Time{}
+	curLastModified := map[models.CveContentType][]time.Time{}
 	curVinfo, ok := current.ScannedCves[cveID]
 	if !ok {
 		return true
 	}
 	for _, cType := range cTypes {
-		if content, ok := curVinfo.CveContents[cType]; ok {
-			curLastModified[cType] = content.LastModified
+		if conts, ok := curVinfo.CveContents[cType]; ok {
+			for _, cont := range conts {
+				curLastModified[cType] = append(curLastModified[cType], cont.LastModified)
+			}
 		}
 	}
 
 	for _, t := range cTypes {
-		if !curLastModified[t].Equal(prevLastModified[t]) {
+		if !reflect.DeepEqual(curLastModified[t], prevLastModified[t]) {
 			logging.Log.Debugf("%s LastModified not equal: \n%s\n%s",
 				cveID, curLastModified[t], prevLastModified[t])
 			return true