aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorhrbrmstr <bob@rud.is>2026-09-14 09:09:14 -0400
committerhrbrmstr <bob@rud.is>2026-09-14 09:09:14 -0400
commitf043cd297f2235682ca9e21572c503b9e78e6f0d (patch)
tree4ed31751594e9c2b99650ab7ab9389f78b60b28b
parent5102ce853135eff384b578fe218a0cb3d377d592 (diff)
fix: fproxHEADmain
-rw-r--r--README.md15
-rw-r--r--fprox.go6
2 files changed, 10 insertions, 11 deletions
diff --git a/README.md b/README.md
index 2ead53b..e2dbd1d 100644
--- a/README.md
+++ b/README.md
@@ -2,10 +2,7 @@
Scan Homebrew for vulnerabilities that already have known exploits.
-`brew-sploits` reads the vulnerabilities that `brew vulns --json` reports for
-your installed formulae. For every real CVE identifier, it asks the fprox
-service whether public proof-of-concepts or exploitation activity exist. It
-prints one JSON report to stdout.
+`brew-sploits` reads the vulnerabilities that `brew vulns --json` reports for your installed formulae. For every real CVE identifier, it asks the fprox service whether public proof-of-concepts or exploitation activity exist. It prints one JSON report to stdout.
## Output
@@ -16,15 +13,13 @@ The report has four fields.
- `non_cve` lists the vulnerability IDs that are not CVEs, such as `OSV-*`.
- `vulnerable_packages` lists the unique Homebrew formulae that the CVEs affect.
-For a single CVE, the tool marks it as exploited when either
-`.props.pageProps.cveInfo.proofOfConcepts` or
-`.props.pageProps.cveInfo.exploitedAt` holds at least one entry.
+For a single CVE, the tool marks it as exploited when either proof-of-concepts exist or proof-of-exploited is true.
## Requirements
- Go 1.26 or later
- Homebrew, with `brew` on `PATH`
-- Network access to `fprox.hrbrmstr.app`
+- A live internet connection
## Build
@@ -47,6 +42,4 @@ and `--version` for the version.
## Limitations
-The tool skips any CVE that the fprox lookup fails to resolve. It writes a
-warning to stderr for each skipped CVE. It never labels a skipped CVE as
-exploited or not exploited.
+The tool skips any CVE that the lookup fails to resolve. It writes a warning to stderr for each skipped CVE. It never labels a skipped CVE as exploited or not exploited.
diff --git a/fprox.go b/fprox.go
index 214ef9a..e91bedf 100644
--- a/fprox.go
+++ b/fprox.go
@@ -38,6 +38,12 @@ func CveHasExploits(cve string) (bool, error) {
return false, nil
}
+// This file was generated from JSON Schema using quicktype, do not modify it directly.
+// To parse and unparse this JSON data, add this code to your project and do:
+//
+// fproxResponse, err := UnmarshalFproxResponse(bytes)
+// bytes, err = fproxResponse.Marshal()
+
func UnmarshalFproxResponse(data []byte) (FproxResponse, error) {
var r FproxResponse
err := json.Unmarshal(data, &r)