fix: harden Trivy integration (scanners, UTF-8 truncate, security findings) - #87
fix: harden Trivy integration (scanners, UTF-8 truncate, security findings)#87Abhinesh Jha (Abhineshhh) wants to merge 5 commits into
Conversation
| Severity: s.Severity, | ||
| RuleID: s.RuleID, | ||
| Title: s.Title, | ||
| Description: truncateString(s.Match, 500), |
There was a problem hiding this comment.
Abhinesh Jha (@Abhineshhh) Trivy v0.69.3 masks the matched secret span before populating Match, so this should not persist raw credentials. However, surrounding source-line text can remain visible, and this description is published through the nightly database and detailed JSON report.
As defense in depth, consider omitting Description for secret findings and retaining only the rule metadata. Alternatively, add a test documenting and protecting the assumption that Trivy supplies a censored value.
There was a problem hiding this comment.
Good catch. I dropped Description for secret findings entirely so Match never reaches the DB or the nightly detailed JSON. Findings now keep only rule metadata (ruleId, title, severity, category) plus the parent Trivy Target as filePath.
TestParseTrivyResult_SecretsAndMisconfigs now feeds a non-empty Match (including surrounding source-line text) and asserts it does not appear on the finding. Also removed the AKIA fixture from the repository test.
Pushed on this branch after rebase onto current main.
Trivy renamed --security-checks to --scanners and deprecates the config scanner name in favor of misconfig. Switch RunTrivy to the supported flags so comprehensive scans keep working when the alias is removed. Fixes microsoft#78
Byte-based slicing in truncateString could cut multi-byte characters mid-rune (CJK, emoji), producing invalid UTF-8 stored in the database and emitted in JSON reports. Truncate by rune while respecting a max byte budget (including ...), and add regression tests for multi-byte inputs. Fixes microsoft#79
Comprehensive scans counted secrets/misconfigurations but never built SecurityFindings, so the security_findings table stayed empty and detail reports could not surface them. Map Trivy secrets and misconfigs into domain findings, store them on the image record, load them (and capabilities) in QueryAllImageDetails, and emit them in the detailed JSON report. Fixes microsoft#73
Replace non-ASCII literals in truncate tests with \u escapes (accented Latin and emoji) so the suite is encoding-stable and language-neutral.
Nightly commits the detailed JSON report to the public repo. Match can include surrounding source-line text even when Trivy masks the secret span, so persist only rule metadata and the parent result path. Addresses review on microsoft#87.
c6733ad to
6b54c06
Compare
2 participants
Description
Consolidated Trivy-related fixes that all touch
pkg/infrastructure/scanner/trivy.go, stacked into one PR to avoid merge conflicts and review thrash.Related Issues
Fixes #78
Fixes #79
Fixes #73
Changes
--scannersflag — replace deprecated--security-checks; usemisconfiginstead ofconfig([Bug]: Trivy invoked with deprecated --security-checks flag #78)truncateString— never cut mid-rune; multi-byte regression tests use ASCII-safe\uescapes ([Bug]: truncateString can produce invalid UTF-8 in vulnerability descriptions #79)SecurityFindings, store in DB, load inQueryAllImageDetails, emit in detailed JSON ([Bug]: Comprehensive Trivy findings are counted but never persisted to security_findings #73)Stack note
This replaces the overlapping single-file PRs #80, #81, and #86 (closed in favor of this consolidated stack).
Checklist
go test ./...passes locallydocs/detailed-report.md)