search

goccy / go-graphviz

Go bindings for Graphviz
MIT License
718 stars 70 forks source link

Graphviz Update? #42

Closed lespea closed 3 weeks ago

lespea commented 3 years ago

One of our internal scanning tools identified the following CVEs present in the included graphviz library: CVE-2019-9904 & CVE-2019-11023. I haven't validated those but I do believe the library is a handful of version behind anyway... not sure how much work it is updating the library code?

Vithanco commented 2 years ago

Indeed, this looks like a valid question. Can we update Graphviz? It currently looks like the Graphviz source and GO source are intermingled. Can we do this differently?

little-nil commented 2 years ago

Do me a favor. I have the same problem

Vithanco commented 2 years ago

Btw, this looks like a really great library. The description sounds like this is my dream. So, this wasn't meant as criticism. I am more interested whether it makes sense to get involved... Hence my request. Can we create this maybe as a fork of Graphviz itself? With the sources of this library as true extension of this fork? I noticed that Graphviz got some maintainers and is picking up speed.

Or any better idea?

I am willing to add some hours to that endeavour as well, but only started learning Go, so I would need help.

goccy commented 2 years ago

I'll prepare a mechanism to easily update the C source of Graphviz. For example, use the following command ( make update/graphviz/{version})

make update/graphviz/2.40.1
Vithanco commented 2 years ago

this sounds fantastic!

little-nil commented 2 years ago

I'll prepare a mechanism to easily update the C source of Graphviz. For example, use the following command ( make update/graphviz/{version})

make update/graphviz/2.40.1

I finally got you. You are the god of salvation. This is a moment to celebrate!

Vithanco commented 2 years ago

Did you ever try to compile towards WebAssembly?

Vithanco commented 2 years ago

I assume WebAssembly doesn't work: imports github.com/goccy/go-graphviz/internal/ccall: build constraints exclude all Go files in ${MyPATH}/pkg/mod/github.com/goccy/go-graphviz@v0.0.9/internal/ccall

TimJJTing commented 2 years ago

Any updates on this?

spacedub commented 2 years ago

@Vithanco did you end-up having a functioning fork with updated upstream graphviz?

Vithanco commented 2 years ago

Sorry, after some further consideration did I choose JavaScript over Go. But I still thinking this is a great library.

Thanks for the follow up & good luck!

spacedub commented 2 years ago

@goccy would love to see this happen - and of course happy to help if you can provide some pointers.

esnible commented 1 year ago

The "Mend" tool complains about three CVEs in the embedded version of GraphViz. Consider replacing the current GraphViz source with newer source. I looked up Mend's complaints, here they are: