golang.org/x/tools package is giving me fortify vulnerability even though I am using latest v0.40.0 ..can you guys help me on resolving the issue & solution tu this vulnerability?
#Fortify bug for golang.org/x/tools
fossil crow
lime patio
fossil crow
Yes
My application never use any jquery related stuffs .. this is a headache...I have been facing this for so long
meager ivy
it looks like it’s in golang.org/x/tools/cmd/present, which is a runnable program and not something that gets built into your program including the module
your options are, then, roughly:
- report the vulnerability and hope it gets fixed, but the fact that it’s so old and likely abandoned means it’s probably not high priority to fix (it might be updating to the program to support an entirely new major version, not just dropping a new version in)
- understand that the tool is reporting something not immediately concerning, and move on
- stop using golang.org/x/tools
there’s no magic bullet here, those really are your options
fossil crow
Is there any replacement for this package? It breaks code if I don't use this package
How can I remove it from my code
meager ivy
it might take some major surgery, yes
spare grail
the tool being stupid to report stuff not in use is the main issue. but you could always fork x/tools and remove everything you don’t use from your fork
fossil crow
How can it be done?
spare grail
you could also go vendor and remove the present/ dir
fossil crow
Go mod vendor directory has no such file ...I have searched that
spare grail
if you’re paying for whatever fortify is, I’d report a bug to them.
and if the vendor dir doesn’t have it shouldn’t the problem be solved? (or again google “how to make a fork of a go module”)