internal/vuln: do not count withdrawn vuln as affecting a package

Currently, withdrawn vulnerabilities are still prominently displayed as
if they are regular vulnerabilities when viewing a package. This is
likely causing a lot of undue noise for users.

Therefore, stop showing withdrawn vulnerabilities, similar to
govulncheck. Users who want to see withdrawn vulnerabilities can check
it directly on pkg.go.dev/vuln.

Fixes golang/go#80941

Change-Id: Idb981b629e4bb31eb3f32e02fbb8cd326a6a6964
Reviewed-on: https://go-review.googlesource.com/c/pkgsite/+/817440
kokoro-CI: kokoro <noreply+kokoro@google.com>
Reviewed-by: Nicholas Husin <husin@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ethan Lee <ethanalee@google.com>

Author: nicholashusin

internal/vuln/client.go

@@ -126,6 +126,9 @@ func (c *Client) modulesFilter(ctx context.Context, filter func(*ModuleMeta) boo
 }
 
 func isAffected(e *osv.Entry, req *PackageRequest) bool {
+	if e.Withdrawn != nil {
+		return false
+	}
 	for _, a := range e.Affected {
 		if a.Module.Path != req.Module || !osv.AffectsSemver(a.Ranges, req.Version) {
 			continue

internal/vuln/vulns_test.go

@@ -74,8 +74,25 @@ func TestVulnsForPackage(t *testing.T) {
 			},
 		}},
 	}
+	withdrawn := osv.Entry{
+		ID:        "GO-2020-0004",
+		Published: jan1999,
+		Withdrawn: &jan2000,
+		Affected: []osv.Affected{{
+			Module: osv.Module{Path: "bad.com"},
+			Ranges: []osv.Range{{
+				Type:   osv.RangeTypeSemver,
+				Events: []osv.RangeEvent{{Introduced: "0"}},
+			}},
+			EcosystemSpecific: osv.EcosystemSpecific{
+				Packages: []osv.Package{{
+					Path: "bad.com/withdrawn",
+				}},
+			},
+		}},
+	}
 
-	client, err := NewInMemoryClient([]*osv.Entry{&e, &e2, &stdlib})
+	client, err := NewInMemoryClient([]*osv.Entry{&e, &e2, &stdlib, &withdrawn})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -115,6 +132,11 @@ func TestVulnsForPackage(t *testing.T) {
 			name: "match - pkg with no fix",
 			mod:  "unfixable.com", pkg: "unfixable.com", version: "v1.999.999", want: []Vuln{{ID: "GO-1999-0001"}},
 		},
+		{
+			name: "no match - withdrawn",
+			mod:  "bad.com", pkg: "bad.com/withdrawn", version: "v1.0.0",
+			want: nil,
+		},
 		// Vulnerabilities for a module (package == "")
 		{
 			name: "no match - module only",

tests/screentest/seed.txt

@@ -14,6 +14,7 @@ github.com/creack/pty@v1.1.0
 github.com/creack/pty/v2@v2.0.1
 github.com/envoyproxy/go-control-plane@v0.9.8
 github.com/envoyproxy/go-control-plane@v0.9.9
+github.com/gorilla/sessions@v1.2.1
 github.com/hashicorp/vault/api@v1.0.3
 github.com/hashicorp/vault/api@v1.1.1
 github.com/hashicorp/vault/api/auth/approle@latest

tests/screentest/testcases.ci.txt

@@ -63,6 +63,11 @@ path /golang.org/x/crypto?tab=versions
 capture viewport
 capture viewport 540x1080
 
+test vuln withdrawn module
+path /github.com/gorilla/sessions@v1.2.1
+capture viewport
+capture viewport 540x1080
+
 test vuln search
 path /search?q=github.com%2Fbeego&m=vuln
 capture viewport