dependency-check / dependency-check/DependencyCheck

golang: checker doesn't take into account replace directives

Open
#3,309 6 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Describe the bug**
For golang projects checker doesn't take into account "replace" directives in go.mod.

**Version of dependency-check used**
6.1.5

**To Reproduce**
Steps to reproduce the behavior:
1. Create test golang project with dependency on github.com/grpc-ecosystem/go-grpc-middleware v1.0.0 in go.mod file.
2. Run checker. CVE-2017-7860 issue exists in report. As expected.
3. Update github.com/grpc-ecosystem/go-grpc-middleware v1.0.0 to github.com/grpc-ecosystem/go-grpc-middleware v1.2.2 in "require" section of go.mod
4. Run checker. CVE-2017-7860 issue doesn't exist. As expected.
5. Change github.com/grpc-ecosystem/go-grpc-middleware v1.2.2 back to github.com/grpc-ecosystem/go-grpc-middleware v1.0.0 in "require" section of go.mod
6. Run checker. CVE-2017-7860 issue exists in report. As expected
7. Add "replace" directive: replace github.com/grpc-ecosystem/go-grpc-middleware => github.com/grpc-ecosystem/go-grpc-middleware v1.2.2
8. Run checker. CVE-2017-7860 issue STILL exists in report, but should not. This shows that checker doesn't take into account "replace" directives and checks 1.0.0 version instead of 1.2.2.

Test project (branches for each case with reports):
https://github.com/Exalax/depcheck-replace-issue/tree/master - go-grpc-middleware 1.0.0 (base state)
https://github.com/Exalax/depcheck-replace-issue/tree/upgrade - go-grpc-middleware 1.2.2 (upgrade via require section)
https://github.com/Exalax/depcheck-replace-issue/tree/replace - go-grpc-middleware 1.2.2 (upgrade via replace section)

**Expected behavior**
When go.mod file has "replace" directives which updates dependency version, checker must check these updated dependencies.
Instead of it, checker still checks dependencies from "require" go.mod section

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.