google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev
https://google.github.io/osv-scanner/
Apache License 2.0
6.26k stars 362 forks source link

feat: error if configuration file has unknown properties #1249

Closed G-Rath closed 1 month ago

G-Rath commented 2 months ago

Currently the scanner does not check if there were unrecognized properties when loading configuration files, meaning that typos can easily slip through; to help avoid this, I've modified tryLoadConfig to return an error if there are any undecoded keys in the metadata.

While this could cause existing configs to start erroring, I don't think this should be considered a breaking change as such configurations would inherently causing different behaviour than what was desired and thus be a downstream bug themselves.

This will also mean that old versions of the scanner going forward would not be compatible with configs for even newer versions of the scanner that introduce new config properties, which is could be a little annoying but I don't think outweighs the benefit of this validation especially given such configurations likewise would result in different behaviour since the old scanner version would not know what to do with the new configuration option.

Resolves #1098

codecov-commenter commented 2 months ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 68.36%. Comparing base (46ab63d) to head (72f897a).

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #1249 +/- ## ========================================== + Coverage 68.31% 68.36% +0.05% ========================================== Files 175 175 Lines 16764 16772 +8 ========================================== + Hits 11452 11467 +15 + Misses 4680 4675 -5 + Partials 632 630 -2 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.