search

google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev
https://google.github.io/osv-scanner/
Apache License 2.0
6.26k stars 362 forks source link

Accept other names for requirements.txt files or provide a way to specify an extractor #1266

Closed lengau closed 1 month ago

lengau commented 1 month ago

I would expect the following command to work, extracting a Python requirements.txt type file:

$ osv-scanner scan --lockfile requirements-dev.txt

Instead it says "could not determine extractor".

G-Rath commented 1 month ago

This is possible by providing the name of the extractor separated with a colon:

$ osv-scanner scan --lockfile requirements.txt:requirements-dev.txt
oliverchang commented 1 month ago

Should we see if we can loosen up some of the detection here to filenames with variations of *requirements*txt ?

@another-rex

oliverchang commented 1 month ago

@lengau do you have a list of filenames where you'd expect this to work?

G-Rath commented 1 month ago

@oliverchang I thought we'd decided not to support alternative names given how many variations there are in the wild, the potential performance impact, and that the colon syntax was meant to enable exactly this situation...

Also see #370 and #67 which this duplicates

oliverchang commented 1 month ago

Yeah, but given that this has come back time and time again, I think we should revisit this to see if we can offer something better out of the box.