x/exp/vulndb/govulncheck: CVEs are not detected in GOPATH mode

[rittneje]

What version of Go are you using (go version)?

$ go version
go version go1.17.7 darwin/amd64

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/tmp/.gocache"
GOENV="/Users/rittneje/Library/Application Support/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/rittneje/test/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/rittneje/test"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/Users/rittneje/go1.17.7"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/Users/rittneje/go1.17.7/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.17.7"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/kf/kr7_s3xx0l12zbj3jrn082hmzy5gvy/T/go-build1057679207=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

go.mod

module cvetest

go 1.16

require (
	golang.org/x/text v0.3.0
)

main.go

package main

import (
	"golang.org/x/text/language"
)

func main() {
	language.Parse("")
}

These files are located under $GOPATH/src/cvetest.

I then ran govulncheck -verbose cvetest in $GOPATH, and again in $GOPATH/src/cvetest.

What did you expect to see?

It should report the same results both times, or it should complain that GOPATH mode is not supported.

What did you see instead?

When run from $GOPATH:

2022/03/10 09:21:12 loading packages...
2022/03/10 09:21:13 	1 loaded packages
2022/03/10 09:21:13 loading database...
2022/03/10 09:21:13 	0 known vulnerabilities.
2022/03/10 09:21:13 building ssa...
2022/03/10 09:21:13 	built ssa
2022/03/10 09:21:13 detecting vulnerabilities...

(Note that it claims to have loaded the package.)

When run from $GOPATH/src/cvetest:

2022/03/10 09:21:36 loading packages...
2022/03/10 09:21:37 	1 loaded packages
2022/03/10 09:21:37 loading database...
2022/03/10 09:21:37 	2 known vulnerabilities.
2022/03/10 09:21:37 building ssa...
2022/03/10 09:21:37 	built ssa
2022/03/10 09:21:37 detecting vulnerabilities...
Findings for vulnerability: GO-2021-0113 (CVE-2021-38561):

Trace:
golang.org/x/text/language.Parse (/Users/rittneje/test/src/cvetest/main.go:8:16)
cvetest.main(...) (/Users/rittneje/test/src/cvetest/main.go:7:6)

[heschi]

cc @jba @zpavlinovic

[zpavlinovic]

When in $GOPATH, it should load the package but it will not pick up the module version, which is needed to check if a vulnerability applies to the code or not. Hence, no vulnerabilities found. I believe the right solution here is to warn the user of this.

I believe the behavior in $GOPATH/src/cvetest is correct as there is a go.mod file.

[gopherbot]

Change https://go.dev/cl/394774 mentions this issue: cmd/govulncheck: fail in GOPATH mode

[jba]

The above CL addresses this in the new govulncheck. The existing one is no longer maintained.

[gopherbot]

Change https://go.dev/cl/395241 mentions this issue: cmd/govulncheck: fail in GOPATH mode