future-architect /
vuls
| Conditions | 10 |
| Total Lines | 78 |
| Code Lines | 44 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
Complex classes like github.FillGitHubSecurityAlerts often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
| 1 | /* Vuls - Vulnerability Scanner |
||
| 36 | func FillGitHubSecurityAlerts(r *models.ScanResult, owner, repo, token string) (nCVEs int, err error) { |
||
| 37 | src := oauth2.StaticTokenSource( |
||
| 38 | &oauth2.Token{AccessToken: token}, |
||
| 39 | ) |
||
| 40 | httpClient := oauth2.NewClient(context.Background(), src) |
||
| 41 | |||
| 42 | // TODO Use `https://github.com/shurcooL/githubv4` if the tool supports vulnerabilityAlerts Endpoint |
||
| 43 | const jsonfmt = `{"query": |
||
| 44 | "query { repository(owner:\"%s\", name:\"%s\") { name, vulnerabilityAlerts(first: %d, %s) { pageInfo{ endCursor, hasNextPage, startCursor}, edges { node { id, externalIdentifier, externalReference, fixedIn, packageName } } } } }"}` |
||
| 45 | after := "" |
||
| 46 | |||
| 47 | for { |
||
| 48 | jsonStr := fmt.Sprintf(jsonfmt, owner, repo, 100, after) |
||
| 49 | req, err := http.NewRequest("POST", |
||
| 50 | "https://api.github.com/graphql", |
||
| 51 | bytes.NewBuffer([]byte(jsonStr)), |
||
| 52 | ) |
||
| 53 | if err != nil { |
||
| 54 | return 0, err |
||
| 55 | } |
||
| 56 | |||
| 57 | // https://developer.github.com/v4/previews/#repository-vulnerability-alerts |
||
| 58 | // To toggle this preview and access data, need to provide a custom media type in the Accept header: |
||
| 59 | // TODO remove this header if it is no longer preview status in the future. |
||
| 60 | req.Header.Set("Accept", "application/vnd.github.vixen-preview+json") |
||
| 61 | req.Header.Set("Content-Type", "application/json") |
||
| 62 | |||
| 63 | resp, err := httpClient.Do(req) |
||
| 64 | if err != nil { |
||
| 65 | return 0, err |
||
| 66 | } |
||
| 67 | defer resp.Body.Close() |
||
| 68 | bodyBytes, err := ioutil.ReadAll(resp.Body) |
||
| 69 | if err != nil { |
||
| 70 | return 0, err |
||
| 71 | } |
||
| 72 | |||
| 73 | alerts := SecurityAlerts{} |
||
| 74 | if err = json.Unmarshal(bodyBytes, &alerts); err != nil { |
||
| 75 | return 0, err |
||
| 76 | } |
||
| 77 | // TODO remove before merging to the master |
||
| 78 | util.Log.Debugf("%s", pp.Sprint(alerts)) |
||
| 79 | |||
| 80 | // TODO add type field to models.Pakcage. |
||
| 81 | // OS Packages ... osPkg |
||
| 82 | // CPE ... CPE |
||
| 83 | // GitHub ... GitHub |
||
| 84 | // WordPress theme ... wpTheme |
||
| 85 | // WordPress plugin ... wpPlugin |
||
| 86 | // WordPress core ... wpCore |
||
| 87 | for _, v := range alerts.Data.Repository.VulnerabilityAlerts.Edges { |
||
| 88 | cveID := v.Node.ExternalIdentifier |
||
| 89 | affectedPkg := models.PackageStatus{Name: v.Node.PackageName} |
||
| 90 | if val, ok := r.ScannedCves[cveID]; ok { |
||
| 91 | val.AffectedPackages = append(val.AffectedPackages, affectedPkg) |
||
| 92 | r.ScannedCves[cveID] = val |
||
| 93 | // TODO add package information to r.Packages |
||
| 94 | // TODO get current version via github API if possible |
||
| 95 | nCVEs++ |
||
| 96 | } else { |
||
| 97 | v := models.VulnInfo{ |
||
| 98 | CveID: cveID, |
||
| 99 | Confidences: models.Confidences{models.GitHubMatch}, |
||
| 100 | AffectedPackages: models.PackageStatuses{affectedPkg}, |
||
| 101 | } |
||
| 102 | r.ScannedCves[cveID] = v |
||
| 103 | // TODO add package information to r.Packages |
||
| 104 | // TODO get current version via github API if possible |
||
| 105 | nCVEs++ |
||
| 106 | } |
||
| 107 | } |
||
| 108 | if !alerts.Data.Repository.VulnerabilityAlerts.PageInfo.HasNextPage { |
||
| 109 | break |
||
| 110 | } |
||
| 111 | after = fmt.Sprintf(`after: \"%s\"`, alerts.Data.Repository.VulnerabilityAlerts.PageInfo.EndCursor) |
||
| 112 | } |
||
| 113 | return nCVEs, err |
||
| 114 | } |
||
| 139 |
