profile: support directives in blocks

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Author: AkihiroSuda

docs/syntax.md

@@ -21,12 +21,14 @@ require (
         example.com/mod201 v1.2.3 // indirect
 )
 
-// policy cannot be specified here because the parser ignores
-// the comment lines here
+//gomodjail:unconfined
 require (
+        example.com/mod300 v1.2.3
+        example.com/mod301 v1.2.3 // gomodjail:confined
+        example.com/mod302 v1.2.3
 )
 ```
 
-This makes the following modules confined: `mod100`, `mod102`, and `mod201`.
+This makes the following modules confined: `mod100`, `mod102`, `mod201`, and `mod301`.
 
 The version numbers are ignored.

pkg/profile/fromgomod/fromgomod.go

@@ -37,37 +37,63 @@ func FromGoMod(mod *modfile.File, prof *profile.Profile) error {
 		}
 	}
 
-	for _, f := range mod.Require {
-		if syn := f.Syntax; syn != nil {
-			pol := currentDefaultPolicy
-			for _, c := range append(syn.Before, syn.Suffix...) {
+	for _, stmt := range mod.Syntax.Stmt {
+		lineBlock, ok := stmt.(*modfile.LineBlock)
+		if !ok {
+			continue
+		}
+		currentBlockDefaultPolicy := currentDefaultPolicy
+		for _, c := range append(lineBlock.Before, lineBlock.Suffix...) {
+			if tok := c.Token; tok != "" {
+				pol, err := policyFromComment(tok)
+				if err != nil {
+					err = fmt.Errorf("failed to parse comment %+v: %w", c, err)
+					return err
+				}
+				if lineBlock.Token[0] != "require" {
+					return fmt.Errorf("policy %q is specified in a non-require block", pol)
+				}
+				currentBlockDefaultPolicy = pol
+			}
+		}
+		for _, line := range lineBlock.Line {
+			if line == nil {
+				continue
+			}
+			pol := currentBlockDefaultPolicy
+			for _, c := range append(line.Before, line.Suffix...) {
 				if tok := c.Token; tok != "" {
 					polFromComment, err := policyFromComment(tok)
 					if err != nil {
 						err = fmt.Errorf("failed to parse comment %+v: %w", c, err)
 						return err
 					}
+					if lineBlock.Token[0] != "require" {
+						return fmt.Errorf("policy %q is specified in a non-require block", polFromComment)
+					}
 					if polFromComment != "" {
 						pol = polFromComment
 					}
 				}
 			}
 			if pol == "" {
-				pol = currentDefaultPolicy
+				pol = currentBlockDefaultPolicy
 			}
 			if pol == profile.PolicyUnconfined {
 				pol = "" // reduce map size
 			}
-			if existPol, ok := prof.Modules[f.Mod.Path]; ok && existPol != pol {
-				slog.Warn("Overwriting an existing policy", "module", f.Mod.Path, "old", existPol, "new", pol)
+			modPath := line.Token[0]
+			if existPol, ok := prof.Modules[modPath]; ok && existPol != pol {
+				slog.Warn("Overwriting an existing policy", "module", modPath, "old", existPol, "new", pol)
 			}
 			if pol == "" {
-				delete(prof.Modules, f.Mod.Path)
+				delete(prof.Modules, modPath)
 			} else {
-				prof.Modules[f.Mod.Path] = pol
+				prof.Modules[modPath] = pol
 			}
 		}
 	}
+
 	return nil
 }
 

pkg/profile/fromgomod/fromgomod_test.go

@@ -74,16 +74,28 @@ require (
 	example.com/mod202 v1.2.3 // indirect
 )
 
-// policy cannot be specified here because the parser ignores
-// the comment lines here
+//gomodjail:unconfined
 require (
+	example.com/mod300 v1.2.3
+	example.com/mod301 v1.2.3 // gomodjail:confined
+	example.com/mod302 v1.2.3
+)
+
+// gomodjail:confined
+require (
+	example.com/mod400 v1.2.3 // indirect
+	example.com/mod401 v1.2.3 // indirect // gomodjail:unconfined
+	example.com/mod402 v1.2.3 // indirect
 )
 `,
 			expected: map[string]string{
 				"example.com/mod100": "confined",
 				"example.com/mod102": "confined",
 				"example.com/mod201": "confined",
 				"example.com/mod202": "confined",
+				"example.com/mod301": "confined",
+				"example.com/mod400": "confined",
+				"example.com/mod402": "confined",
 			},
 		},
 	}