From cf297bca409d76c3f847e85e632c52e9a71b4f1d Mon Sep 17 00:00:00 2001
From: Pohan Huang <pohan.huang@suse.com>
Date: Fri, 23 Oct 2026 02:36:09 +0800
Subject: [PATCH] feat: spread php-src to other php module

Signed-off-by: pohanhuang <pohan.huang@suse.com>
---
 updater/fetchers/apps/ghsa.go | 41 +++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/updater/fetchers/apps/ghsa.go b/updater/fetchers/apps/ghsa.go
index f6f67b5..d59c39b 100644
--- a/updater/fetchers/apps/ghsa.go
+++ b/updater/fetchers/apps/ghsa.go
@@ -71,9 +71,50 @@ func ghsaUpdate() error {
 	loadGHSAData(nugetDataFile, ".NET", ".NET:", false)
 	loadGHSAData(golangDataFile, "golang", "go:", false)
 	loadGHSAData(phpDataFile, "php", "php:", true)
+	spreadPHPSrcVuls()
 	return nil
 }
 
+// spreadPHPSrcVuls copies php:php-src vulnerabilities into every other php:*
+// module already in vulMap, then removes the php:php-src entries.
+func spreadPHPSrcVuls() {
+	const srcModule = "php:php-src"
+
+	phpSrcVuls := make([]*common.AppModuleVul, 0)
+	phpSrcKeys := make([]string, 0)
+	phpModules := make(map[string]struct{})
+
+	for key, mv := range vulMap {
+		if mv.ModuleName == srcModule {
+			phpSrcVuls = append(phpSrcVuls, mv)
+			phpSrcKeys = append(phpSrcKeys, key)
+		} else if strings.HasPrefix(mv.ModuleName, "php:") {
+			phpModules[mv.ModuleName] = struct{}{}
+		}
+	}
+
+	if len(phpSrcVuls) == 0 {
+		return
+	}
+
+	for _, mv := range phpSrcVuls {
+		for mod := range phpModules {
+			copy := *mv
+			copy.ModuleName = mod
+			copy.AffectedVer = append([]common.AppModuleVersion{}, mv.AffectedVer...)
+			copy.FixedVer = append([]common.AppModuleVersion{}, mv.FixedVer...)
+			copy.CVEs = append([]string{}, mv.CVEs...)
+			addAppVulMap(&copy)
+		}
+	}
+
+	for _, key := range phpSrcKeys {
+		delete(vulMap, key)
+	}
+
+	log.WithFields(log.Fields{"cves": len(phpSrcVuls), "modules": len(phpModules)}).Info("spread php:php-src vulnerabilities")
+}
+
 func cleanupVersion(version string) string {
 	return jreRegex.ReplaceAllString(version, "")
 }