future-architect /
vuls
| Conditions | 12 |
| Total Lines | 84 |
| Code Lines | 54 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
Complex classes like github.FillGitHubSecurityAlerts often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
| 1 | /* Vuls - Vulnerability Scanner |
||
| 38 | func FillGitHubSecurityAlerts(r *models.ScanResult, owner, repo, token string) (nCVEs int, err error) { |
||
| 39 | src := oauth2.StaticTokenSource( |
||
| 40 | &oauth2.Token{AccessToken: token}, |
||
| 41 | ) |
||
| 42 | httpClient := oauth2.NewClient(context.Background(), src) |
||
| 43 | |||
| 44 | // TODO Use `https://github.com/shurcooL/githubv4` if the tool supports vulnerabilityAlerts Endpoint |
||
| 45 | const jsonfmt = `{"query": |
||
| 46 | "query { repository(owner:\"%s\", name:\"%s\") { url, vulnerabilityAlerts(first: %d, %s) { pageInfo{ endCursor, hasNextPage, startCursor}, edges { node { id, externalIdentifier, externalReference, fixedIn, packageName, dismissReason, dismissedAt } } } } }"}` |
||
| 47 | after := "" |
||
| 48 | |||
| 49 | for { |
||
| 50 | jsonStr := fmt.Sprintf(jsonfmt, owner, repo, 100, after) |
||
| 51 | req, err := http.NewRequest("POST", |
||
| 52 | "https://api.github.com/graphql", |
||
| 53 | bytes.NewBuffer([]byte(jsonStr)), |
||
| 54 | ) |
||
| 55 | if err != nil { |
||
| 56 | return 0, err |
||
| 57 | } |
||
| 58 | |||
| 59 | // https://developer.github.com/v4/previews/#repository-vulnerability-alerts |
||
| 60 | // To toggle this preview and access data, need to provide a custom media type in the Accept header: |
||
| 61 | // MEMO: I tried to get the affected version via GitHub API. Bit it seems difficult to determin the affected version if there are multiple dependency files such as package.json. |
||
| 62 | // TODO remove this header if it is no longer preview status in the future. |
||
| 63 | req.Header.Set("Accept", "application/vnd.github.vixen-preview+json") |
||
| 64 | req.Header.Set("Content-Type", "application/json") |
||
| 65 | |||
| 66 | resp, err := httpClient.Do(req) |
||
| 67 | if err != nil { |
||
| 68 | return 0, err |
||
| 69 | } |
||
| 70 | defer resp.Body.Close() |
||
| 71 | bodyBytes, err := ioutil.ReadAll(resp.Body) |
||
| 72 | if err != nil { |
||
| 73 | return 0, err |
||
| 74 | } |
||
| 75 | |||
| 76 | alerts := SecurityAlerts{} |
||
| 77 | if err = json.Unmarshal(bodyBytes, &alerts); err != nil { |
||
| 78 | return 0, err |
||
| 79 | } |
||
| 80 | |||
| 81 | util.Log.Debugf("%s", pp.Sprint(alerts)) |
||
| 82 | |||
| 83 | for _, v := range alerts.Data.Repository.VulnerabilityAlerts.Edges { |
||
| 84 | if config.Conf.IgnoreGitHubDismissed && v.Node.DismissReason != "" { |
||
| 85 | continue |
||
| 86 | } |
||
| 87 | |||
| 88 | pkgName := fmt.Sprintf("%s %s", |
||
| 89 | alerts.Data.Repository.URL, v.Node.PackageName) |
||
| 90 | |||
| 91 | m := models.GitHubSecurityAlert{ |
||
| 92 | PackageName: pkgName, |
||
| 93 | FixedIn: v.Node.FixedIn, |
||
| 94 | AffectedRange: v.Node.AffectedRange, |
||
| 95 | Dismissed: len(v.Node.DismissReason) != 0, |
||
| 96 | DismissedAt: v.Node.DismissedAt, |
||
| 97 | DismissReason: v.Node.DismissReason, |
||
| 98 | } |
||
| 99 | |||
| 100 | cveID := v.Node.ExternalIdentifier |
||
| 101 | |||
| 102 | if val, ok := r.ScannedCves[cveID]; ok { |
||
| 103 | val.GitHubSecurityAlerts = val.GitHubSecurityAlerts.Add(m) |
||
| 104 | r.ScannedCves[cveID] = val |
||
| 105 | nCVEs++ |
||
| 106 | } else { |
||
| 107 | v := models.VulnInfo{ |
||
| 108 | CveID: cveID, |
||
| 109 | Confidences: models.Confidences{models.GitHubMatch}, |
||
| 110 | GitHubSecurityAlerts: models.GitHubSecurityAlerts{m}, |
||
| 111 | } |
||
| 112 | r.ScannedCves[cveID] = v |
||
| 113 | nCVEs++ |
||
| 114 | } |
||
| 115 | } |
||
| 116 | if !alerts.Data.Repository.VulnerabilityAlerts.PageInfo.HasNextPage { |
||
| 117 | break |
||
| 118 | } |
||
| 119 | after = fmt.Sprintf(`after: \"%s\"`, alerts.Data.Repository.VulnerabilityAlerts.PageInfo.EndCursor) |
||
| 120 | } |
||
| 121 | return nCVEs, err |
||
| 122 | } |
||
| 153 |
