sonatype-nexus-community / nancy

A tool to check for vulnerabilities in your Golang dependencies, powered by Sonatype OSS Index
Apache License 2.0
564 stars 74 forks source link

Inconsistency when stdin is from file [bug] #92

Closed AndreyMZ closed 4 years ago

AndreyMZ commented 4 years ago

Steps to reproduce

  1. Try variant 1:

    go list -m all | nancy
  2. Try variant 2:

    go list -m all > go-list.txt
    nancy < go-list.txt

Actual result

The variant 1 works OK, variant 2 does not work (prints the usage):

C:\nancy>go list -m all | nancy
<...>
2020/03/11 22:45:54 Nancy version: development
Nancy version: development
[1/38]pkg:golang/github.com/AndreasBriese/bbloom@0.0.0-20180913140656-343706a395b7   No known vulnerabilities against package/version
[2/38]pkg:golang/github.com/BurntSushi/toml@0.3.1   No known vulnerabilities against package/version
<...>
[38/38]pkg:golang/github.com/go-yaml/yaml@2.2.2   No known vulnerabilities against package/version

Audited dependencies:38,Vulnerable:0

C:\nancy>go list -m all > go-list.txt

C:\nancy>nancy < go-list.txt
<...>
2020/03/11 22:46:14 Nancy version: development
Usage:
        go list -m all | nancy [options]
        go list -m all | nancy iq [options]
        nancy [options] </path/to/Gopkg.lock>
        nancy [options] </path/to/go.sum>

Options:
<...>

Expected result

Both variants work identically.

cc @bhamail / @DarthHater

DarthHater commented 4 years ago

Interesting. I am a cat abuser so I've definitely not run into this. I'll take a look. Why are you putting it in a file rather than just piping the command (trying to understand the use case)?

DarthHater commented 4 years ago

Looks like it's probably related to:

    if (fi.Mode() & os.ModeNamedPipe) == 0 {
        flag.Usage()
        os.Exit(1)
    }

in main.go, basically it's checking for pipe, not a redirect like you've done.

AndreyMZ commented 4 years ago

Why are you putting it in a file rather than just piping the command (trying to understand the use case)?

  1. To review the content of go-list.txt before running nancy.
  2. To save the go-list.txt artifact for the future.
bhamail commented 4 years ago

Not a solution, but maybe a workaround: pipe the text file into nancy:

go list -m all > go-list.txt
cat go-list.txt | nancy