fix(go): merge nested flags into string for ldflags for Go binaries (#…

…8368)
aquasecurity · Feb 13, 2025 · b675b06 · b675b06
1 parent f9c5043
commit b675b06
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 1 deletion.
diff --git a/pkg/dependency/parser/golang/binary/parse.go b/pkg/dependency/parser/golang/binary/parse.go
@@ -9,6 +9,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/mattn/go-shellwords"
 	"github.com/samber/lo"
 	"github.com/spf13/pflag"
 	"golang.org/x/mod/semver"
@@ -145,7 +146,13 @@ func (p *Parser) ldFlags(settings []debug.BuildSetting) []string {
 			continue
 		}
 
-		return strings.Fields(setting.Value)
+		flags, err := shellwords.Parse(setting.Value)
+		if err != nil {
+			p.logger.Error("Could not parse -ldflags found in build info", log.Err(err))
+			return nil
+		}
+
+		return flags
 	}
 	return nil
 }
@@ -163,6 +170,8 @@ func (p *Parser) ParseLDFlags(name string, flags []string) string {
 	// to handle that edge case.
 	var x map[string]string
 	fset.StringToStringVarP(&x, "", "X", nil, "")
+	// Init `help` flag to avoid error in flags with `h` (e.g. `-lpthread`)
+	fset.BoolP("help", "h", false, "just to disable the built-in help flag")
 	if err := fset.Parse(flags); err != nil {
 		p.logger.Error("Could not parse -ldflags found in build info", log.Err(err))
 		return ""

diff --git a/pkg/dependency/parser/golang/binary/parse_test.go b/pkg/dependency/parser/golang/binary/parse_test.go
@@ -390,6 +390,21 @@ func TestParser_ParseLDFlags(t *testing.T) {
 			},
 			want: "",
 		},
+		{
+			name: "flag with nested flags",
+			args: args{
+				name: "github.com/k3s-io/k3s",
+				flags: []string{
+					"-X",
+					"github.com/k3s-io/k3s/version.Version=v1.28.6+k3s2",
+					"-w",
+					"-s",
+					"-extldflags",
+					"-static -lm -ldl -lz -lpthread",
+				},
+			},
+			want: "v1.28.6+k3s2",
+		},
 		{
 			name: "with no flags",
 			args: args{