search

aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
https://aquasecurity.github.io/trivy
Apache License 2.0
23.36k stars 2.31k forks source link

Add ability to disable specific analyzers #3987

Open adamcohen2 opened 1 year ago

adamcohen2 commented 1 year ago

As explained in this discussion, it's not currently possible to run Trivy >= 0.38.0 in an offline environment without pre-fetching the java-db.tar.gz file from ghcr.io/aquasecurity/trivy-java-db:1 which is 418MB.

This feature request is to add a --disable-jar-scan (or other appropriately named flag) to allow users to run Trivy in an offline environment without JAR scanning capabilities. Adding such a flag would avoid the requirement of fetching the 418MB java-db.tar.gz for those who don't need JAR scanning.

candrews commented 1 year ago

I think having the optional to disable jar scanning is great and should be added.

However, I think Trivy should caution users and make it very clear that using this option (should it be added) will result in Trivy being unable to discover and report against dependencies as one might expect.

For example, let there be an image containing log4j.jar and have Trivy scan it. Currently, Trivy will use the Java DB is discover that this jar is log4j-core 2.14.0 and therefore report the log4shell vulnerability. With this --disable-jar-scan argument, Trivy wouldn't know what log4j.jar is and therefore wouldn't report log4jshell resulting in a very important vulnerability being missed.

Airgapped environments are usually particularly sensitive to security, so it would be a shame to have users trying to meet that requirement accidentally cause Trivy's security scanning to significantly regress by use of this option.

kangsumang commented 1 year ago

Is the --disable-jar-scan flag available in the higher versions?

adamcohen2 commented 1 year ago

Is the --disable-jar-scan flag available in the higher versions?

I don't see a disable-jar-scan flag in the trivy source, where is this flag defined?

kangsumang commented 1 year ago

Is the --disable-jar-scan flag available in the higher versions?

I don't see a disable-jar-scan flag in the trivy source, where is this flag defined?

Is there another way to skip jar scanning in trivy?

adamcohen2 commented 1 year ago

Is the --disable-jar-scan flag available in the higher versions?

I don't see a disable-jar-scan flag in the trivy source, where is this flag defined?

Is there another way to skip jar scanning in trivy?

no, that's the point of this very feature request - to add a flag to disable jar scanning.

knqyf263 commented 1 year ago

I think --disable-analyzer jar is better so that we can disable other analyzers in the same way. We have it internally. We can just export it.