search

google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev
https://google.github.io/osv-scanner/
Apache License 2.0
6.02k stars 337 forks source link

Errors spamming the stderr output #1005

Open another-rex opened 1 month ago

another-rex commented 1 month ago

Some errors should only be displayed once, but spams the output because of its location in the code flow.

Currently the only example of this I have is :

https://github.com/google/osv-scanner/blob/main/internal/local/check.go/#L147-L148

Solution proposed: Have some global hashmap that checks if this error has already been logged and don't repeat the log.

G-Rath commented 1 month ago

Can you provide a reproduction for that specific example? as it sounds like a potential bug.

The whole concept though of not spamming errors sounds good

another-rex commented 1 month ago

Call osv-scanner --experimental-offline . without a local-db already set up, and it'll print one error per package that's scanned, since the error is in MakeRequest. So it's working as intended, it's just not great UX.