feat: support checking packages exist for the Drupal ecosystem

Signed-off-by: Gareth Jones <3151613+G-Rath@users.noreply.github.com>

Author: G-Rath

tools/osv-linter/internal/checks/packages.go

@@ -37,9 +37,14 @@ func PackageExists(json *gjson.Result, config *Config) (findings []CheckError) {
 		if !maybePackage.Exists() {
 			return true // keep iterating (over affected entries)
 		}
-		// Normalize ecosystems with a colon to their base.
+		ecosystem := value.Get("package.ecosystem").String()
+
+		// Normalize ecosystems with a colon to their base, except for the Drupal ecosystem
+		// as different repositories are used depending on the suffix
 		// e.g. "Alpine:v3.5" -> "Alpine"
-		ecosystem := strings.Split(value.Get("package.ecosystem").String(), ":")[0]
+		if !strings.HasPrefix(ecosystem, "Drupal") {
+			ecosystem = strings.Split(ecosystem, ":")[0]
+		}
 		// Use config.Ecosystems as an allowlist, if it is set.
 		if len(config.Ecosystems) > 0 && !slices.Contains(config.Ecosystems, ecosystem) {
 			return true // keep iterating (over affected entries)

tools/osv-linter/internal/pkgchecker/ecosystems.go

@@ -13,6 +13,7 @@ var SupportedEcosystems = []string{
 	"NuGet",
 	"RubyGems",
 	"Packagist",
+	"Drupal",
 	"Pub",
 	"Hackage",
 	"Maven",
@@ -27,6 +28,7 @@ var EcosystemBaseURLs = map[string]string{
 	"NuGet":     "https://api.nuget.org/v3-flatcontainer",
 	"RubyGems":  "https://rubygems.org/api/v1/gems",
 	"Packagist": "https://repo.packagist.org/p2",
+	"Drupal":    "https://packages.drupal.org/files/packages/8/p2",
 	"Pub":       "https://pub.dev/api/packages",
 	"Hackage":   "https://hackage.haskell.org/package",
 	"Maven":     "https://search.maven.org/solrsearch/select",
@@ -52,6 +54,8 @@ func ExistsInEcosystem(pkg string, ecosystem string) bool {
 	case "Debian":
 		return true
 	case "Drupal":
+		return existsInDrupal(pkg)
+	case "Drupal:7":
 		return true
 	case "GIT":
 		return true
@@ -140,7 +144,6 @@ func VersionsExistInEcosystem(pkg string, versions []string, ecosystem string) e
 		return nil
 	case "Drupal":
 		return nil
-	case "Drupal": return nil
 	case "GIT":
 		return nil
 	case "GitHub Actions":

tools/osv-linter/internal/pkgchecker/package_check.go

@@ -86,6 +86,13 @@ func existsInPackagist(pkg string) bool {
 	return checkPackageExists(packageInstanceURL)
 }
 
+// Validate the existence of a package in Packagist.
+func existsInDrupal(pkg string) bool {
+	packageInstanceURL := fmt.Sprintf("%s/%s.json", EcosystemBaseURLs["Drupal"], pkg)
+
+	return checkPackageExists(packageInstanceURL)
+}
+
 // Validate the existence of a package in PyPI.
 func existsInPyPI(pkg string) bool {
 	ecosystem := "PyPI"

tools/osv-linter/internal/pkgchecker/package_check_test.go

@@ -144,6 +144,33 @@ func Test_existsInPackagist(t *testing.T) {
 	}
 }
 
+func Test_existsInDrupal(t *testing.T) {
+	tests := []struct {
+		name string
+		pkg  string
+		want bool
+		ver  string
+	}{
+		{
+			name: "existing package",
+			pkg:  "drupal/tfa",
+			want: true,
+		},
+		{
+			name: "non-existing package",
+			pkg:  "non-existing-package",
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := existsInDrupal(tt.pkg); got != tt.want {
+				t.Errorf("existsInDrupal() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
 func Test_existsInPub(t *testing.T) {
 	tests := []struct {
 		name string