search

aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
https://aquasecurity.github.io/trivy
Apache License 2.0
23.63k stars 2.32k forks source link

errors occured in some repositories #3941

Closed gr22d closed 1 year ago

gr22d commented 1 year ago

Description

When using the repo scan in Trivy (0.38.3), an error occurs when executing the trivy github(https://github.com/aquasecurity/trivy). However, it works normally on Trivy (0.36.1)

What did you expect to happen?

error occured on some repositories (ex. https://github.com/aquasecurity/trivy)

What happened instead?

it works normally on Trivy (0.36.1)

Output of run with -debug:

trivy repo https://github.com/aquasecurity/trivy --debug
2023-03-31T14:01:56.399+0900    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-03-31T14:01:56.441+0900    DEBUG   cache dir:  /Users/test/Library/Caches/trivy
2023-03-31T14:01:56.441+0900    DEBUG   DB update was skipped because the local DB is the latest
2023-03-31T14:01:56.441+0900    DEBUG   DB Schema: 2, UpdatedAt: 2023-03-31 00:52:35.283482402 +0000 UTC, NextUpdate: 2023-03-31 06:52:35.283481902 +0000 UTC, DownloadedAt: 2023-03-31 04:59:45.815396 +0000 UTC
2023-03-31T14:01:56.441+0900    INFO    Vulnerability scanning is enabled
2023-03-31T14:01:56.441+0900    DEBUG   Vulnerability type:  [library]
2023-03-31T14:01:56.441+0900    INFO    Secret scanning is enabled
2023-03-31T14:01:56.441+0900    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-03-31T14:01:56.441+0900    INFO    Please see also https://aquasecurity.github.io/trivy/v0.38/docs/secret/scanning/#recommendation for faster secret detection
Enumerating objects: 17062, done.
Counting objects: 100% (17062/17062), done.
Compressing objects: 100% (7996/7996), done.
Total 17062 (delta 8516), reused 13342 (delta 5477), pack-reused 0
2023-03-31T14:03:26.024+0900    DEBUG   No secret config detected: trivy-secret.yaml
2023-03-31T14:03:26.024+0900    DEBUG   Walk the file tree rooted at '/var/folders/gf/9r4f26_s4vdgsrxw45q_pvk80000gn/T/fanal-remote1649786624' in parallel
2023-03-31T14:03:26.030+0900    DEBUG   Resolving com.fasterxml.jackson.core:jackson-databind:2.9.1...
2023-03-31T14:03:26.081+0900    DEBUG   Start parent: com.fasterxml.jackson:jackson-bom:2.9.1
2023-03-31T14:03:26.089+0900    DEBUG   Start parent: com.fasterxml.jackson:jackson-parent:2.9.1
2023-03-31T14:03:26.097+0900    DEBUG   Analysis error: unable to parse yarn.lock: failed to parse pkg/fanal/analyzer/language/nodejs/yarn/testdata/sad/yarn.lock: failed to parse package pattern: 'asap@unsupported:~2.0.6:', unknown protocol: 'unsupported'
2023-03-31T14:03:26.097+0900    DEBUG   Start parent: com.fasterxml:oss-parent:30
2023-03-31T14:03:26.104+0900    DEBUG   Analysis error: unable to parse pkg/fanal/analyzer/language/nodejs/npm/testdata/sad/package-lock.json: failed to parse pkg/fanal/analyzer/language/nodejs/npm/testdata/sad/package-lock.json: decode error: error at line 1, column 3: expecting string delimiter
2023-03-31T14:03:26.108+0900    DEBUG   Analysis error: error with Cargo.lock: failed to parse pkg/fanal/analyzer/language/rust/cargo/testdata/sad/Cargo.lock: decode error: toml: line 1: unexpected end of table name (table names cannot be empty)
2023-03-31T14:03:26.110+0900    DEBUG   Exit parent: com.fasterxml:oss-parent:30
2023-03-31T14:03:26.110+0900    DEBUG   Exit parent: com.fasterxml.jackson:jackson-parent:2.9.1
2023-03-31T14:03:26.110+0900    DEBUG   Exit parent: com.fasterxml.jackson:jackson-bom:2.9.1
2023-03-31T14:03:26.110+0900    DEBUG   Resolving com.fasterxml.jackson.core:jackson-annotations:2.9.0...
2023-03-31T14:03:26.115+0900    DEBUG   Analysis error: pkg/fanal/analyzer/language/java/pom/testdata/broken/pom.xml parse error: failed to parse pkg/fanal/analyzer/language/java/pom/testdata/broken/pom.xml: failed to parse POM: xml decode error: EOF
2023-03-31T14:03:26.116+0900    DEBUG   Resolving org.example:example-api:...
2023-03-31T14:03:26.117+0900    DEBUG   Start parent: com.fasterxml.jackson:jackson-parent:2.9.0
2023-03-31T14:03:26.121+0900    DEBUG   org.example:example-api: was not found in local/remote repositories
2023-03-31T14:03:26.126+0900    DEBUG   Start parent: com.fasterxml:oss-parent:28
2023-03-31T14:03:26.128+0900    DEBUG   Analysis error: error with composer.lock: failed to parse pkg/fanal/analyzer/language/php/composer/testdata/sad/composer.lock: decode error: unexpected EOF
2023-03-31T14:03:26.134+0900    DEBUG   Exit parent: com.fasterxml:oss-parent:28
2023-03-31T14:03:26.134+0900    DEBUG   Exit parent: com.fasterxml.jackson:jackson-parent:2.9.0
2023-03-31T14:03:26.134+0900    DEBUG   Resolving com.fasterxml.jackson.core:jackson-core:2.9.1...
2023-03-31T14:03:26.141+0900    DEBUG   Start parent: com.fasterxml.jackson:jackson-parent:2.9.1
2023-03-31T14:03:26.141+0900    DEBUG   Exit parent: com.fasterxml.jackson:jackson-parent:2.9.1
2023-03-31T14:03:26.151+0900    DEBUG   Poetry: pkg/fanal/analyzer/language/python/poetry/testdata/no-pyproject/pyproject.toml not found
2023-03-31T14:03:26.329+0900    FATAL   repository scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:439
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:266
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.scan
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:668
  - failed analysis:
    github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact
        github.com/aquasecurity/trivy/pkg/scanner/scan.go:146
  - remote repository error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/remote.Artifact.Inspect
        github.com/aquasecurity/trivy/pkg/fanal/artifact/remote/git.go:102
  - post analysis error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect
        github.com/aquasecurity/trivy/pkg/fanal/artifact/local/fs.go:161
  - post analysis error:
    github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze
        github.com/aquasecurity/trivy/pkg/fanal/analyzer/analyzer.go:486
  - poetry walk error:
    github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/python/poetry.poetryAnalyzer.PostAnalyze
        github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/python/poetry/poetry.go:66
  - parse error:
    github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/python/poetry.poetryAnalyzer.PostAnalyze.func2
        github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/python/poetry/poetry.go:52
  - unable to parse poetry.lock:
    github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/python/poetry.poetryAnalyzer.parsePoetryLock
        github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/python/poetry/poetry.go:90
  - failed to decode poetry.lock:
    github.com/aquasecurity/go-dep-parser/pkg/python/poetry.(*Parser).Parse
        github.com/aquasecurity/go-dep-parser@v0.0.0-20230309121549-fcc0deb06781/pkg/python/poetry/parse.go:40
  - toml: line 1: unexpected end of table name (table names cannot be empty)

Output of trivy -v:

trivy -v
Version: 0.38.3
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-03-31 00:52:35.283482402 +0000 UTC
  NextUpdate: 2023-03-31 06:52:35.283481902 +0000 UTC
  DownloadedAt: 2023-03-31 04:59:45.815396 +0000 UTC
Policy Bundle:
  Digest: sha256:714272c66dfff71107a717b64960f00d54883d7268e30e321cbe89c9ecac0f93
  DownloadedAt: 2023-03-30 04:39:27.613272 +0000 UTC

Additional details (base image name, container registry info...):

DmitriyLewen commented 1 year ago

Hello @gr22d Thanks for your report!

Trivy repository contains broken files to use for error checking. (e.g. for you case - https://github.com/aquasecurity/trivy/blob/main/pkg/fanal/analyzer/language/python/poetry/testdata/sad/poetry.lock). You need to skip these files to scanning. e.g. we skip next folders - https://github.com/aquasecurity/trivy/blob/428ee19cae8264d4090c0c4c1ffe25357f1d1af3/.github/workflows/scan.yaml#L20

I close this issue. Feel free to reopen this issue, if you still have questions.

Best Regards, Dmitriy