fix: safeguard against attempting to (re)use partially loaded databases

Author: G-Rath

internal/clients/clientimpl/localmatcher/localmatcher.go

@@ -49,6 +49,15 @@ func NewLocalMatcher(localDBPath string, userAgent string, downloadDB bool) (*Lo
 func (matcher *LocalMatcher) MatchVulnerabilities(ctx context.Context, invs []*extractor.Package) ([][]*osvschema.Vulnerability, error) {
 	results := make([][]*osvschema.Vulnerability, 0, len(invs))
 
+	// ensure all databases loaded so far have been fully loaded; this is just a
+	// basic safeguard since we don't actually currently attempt to reuse matchers
+	// across scans, and its possible we never will, so we don't need to be smart
+	for _, db := range matcher.dbs {
+		if db.Partial {
+			return nil, errors.New("local matcher cannot be (re)used with a partially loaded database")
+		}
+	}
+
 	for _, inv := range invs {
 		if ctx.Err() != nil {
 			return nil, ctx.Err()
@@ -86,6 +95,8 @@ func (matcher *LocalMatcher) MatchVulnerabilities(ctx context.Context, invs []*e
 
 // LoadEcosystem tries to preload the ecosystem into the cache, and returns an error if the ecosystem
 // cannot be loaded.
+//
+// Preloaded databases include every advisory, so can be reused.
 func (matcher *LocalMatcher) LoadEcosystem(ctx context.Context, eco osvecosystem.Parsed) error {
 	_, err := matcher.loadDBFromCache(ctx, eco, nil)
 

internal/clients/clientimpl/localmatcher/zip.go

@@ -36,6 +36,10 @@ type ZipDB struct {
 	Vulnerabilities []osvschema.Vulnerability
 	// User agent to query with
 	UserAgent string
+
+	// whether this database only has some of the advisories
+	// loaded from the underlying zip file
+	Partial bool
 }
 
 var ErrOfflineDatabaseNotFound = errors.New("no offline version of the OSV database is available")
@@ -231,6 +235,9 @@ func NewZippedDB(ctx context.Context, dbBasePath, name, url, userAgent string, o
 		Offline:    offline,
 		StoredAt:   path.Join(dbBasePath, name, "all.zip"),
 		UserAgent:  userAgent,
+
+		// we only fully load the database if we're not provided a list of packages
+		Partial: len(invs) != 0,
 	}
 	names := make([]string, 0, len(invs))
 

internal/clients/clientimpl/localmatcher/zip_test.go

@@ -185,6 +185,9 @@ func TestNewZippedDB_Offline_WithCache(t *testing.T) {
 		t.Fatalf("unexpected error \"%v\"", err)
 	}
 
+	if db.Partial != false {
+		t.Errorf("db is incorrectly marked as partially loaded")
+	}
 	expectDBToHaveOSVs(t, db, osvs)
 }
 
@@ -245,6 +248,9 @@ func TestNewZippedDB_Online_WithoutCache(t *testing.T) {
 		t.Fatalf("unexpected error \"%v\"", err)
 	}
 
+	if db.Partial != false {
+		t.Errorf("db is incorrectly marked as partially loaded")
+	}
 	expectDBToHaveOSVs(t, db, osvs)
 }
 
@@ -277,6 +283,9 @@ func TestNewZippedDB_Online_WithoutCacheAndNoHashHeader(t *testing.T) {
 		t.Fatalf("unexpected error \"%v\"", err)
 	}
 
+	if db.Partial != false {
+		t.Errorf("db is incorrectly marked as partially loaded")
+	}
 	expectDBToHaveOSVs(t, db, osvs)
 }
 
@@ -315,6 +324,9 @@ func TestNewZippedDB_Online_WithSameCache(t *testing.T) {
 		t.Fatalf("unexpected error \"%v\"", err)
 	}
 
+	if db.Partial != false {
+		t.Errorf("db is incorrectly marked as partially loaded")
+	}
 	expectDBToHaveOSVs(t, db, osvs)
 }
 
@@ -353,6 +365,9 @@ func TestNewZippedDB_Online_WithDifferentCache(t *testing.T) {
 		t.Fatalf("unexpected error \"%v\"", err)
 	}
 
+	if db.Partial != false {
+		t.Errorf("db is incorrectly marked as partially loaded")
+	}
 	expectDBToHaveOSVs(t, db, osvs)
 }
 
@@ -411,6 +426,9 @@ func TestNewZippedDB_Online_WithBadCache(t *testing.T) {
 		t.Fatalf("unexpected error \"%v\"", err)
 	}
 
+	if db.Partial != false {
+		t.Errorf("db is incorrectly marked as partially loaded")
+	}
 	expectDBToHaveOSVs(t, db, osvs)
 }
 
@@ -437,6 +455,9 @@ func TestNewZippedDB_FileChecks(t *testing.T) {
 		t.Fatalf("unexpected error \"%v\"", err)
 	}
 
+	if db.Partial != false {
+		t.Errorf("db is incorrectly marked as partially loaded")
+	}
 	expectDBToHaveOSVs(t, db, osvs)
 }
 
@@ -497,6 +518,11 @@ func TestNewZippedDB_WithSpecificPackages(t *testing.T) {
 		t.Fatalf("unexpected error \"%v\"", err)
 	}
 
+	// we are loaded for specific packages
+	if db.Partial != true {
+		t.Errorf("db is incorrectly marked as fully loaded")
+	}
+
 	expectDBToHaveOSVs(t, db, []osvschema.Vulnerability{
 		{
 			ID: "GHSA-2",