Update trivy from 0.35.0 to 0.49.1 (#1806)

* Update trivy 0.35.0->0.48.0 - Specify oras-go 1.2.4 in indirect dependencies docker/docker changes a part of its API at 24.0 - registry: return concrete service type · moby/moby@7b3acdf - 7b3acdff5d (diff-8325eae896b1149bf92c826d07fc29005b1b102000b766ffa5a238d791e0849bR18-R21) oras-go 1.2.3 uses 23.0.1 and trivy transitively depends on docker/docker 24.y.z. There is a build error between oras-go and docker/dockr. - Update disabled analyzers - Update language scanners, enable all of them * move javadb init to scan.go * Add options for java db init() * Update scanner/base.go * Remove unused codes * Add some lock file names * Typo fix * Remove space character (0x20) * Add java-db options for integration scan * Minor fomartting fix * minor fix * conda is NOT supported by Trivy for library scan * Configure trivy log in report command too * Init trivy in scanner * Use trivy's jar.go and replace client which does almost nothing * mv jar.go * Add sha1 hash to result and add filepath for report phase * Undo added 'vuls scan' options * Update oras-go to 1.2.4 * Move Java DB related config items to report side * Add java db search in detect phase * filter top level jar only * Update trivy to 0.49.1 * go mod tidy * Update to newer interface * Refine lock file list, h/t MaineK00n * Avoid else clauses if possible, h/t MaineK00n * Avoid missing word for find and lang types, h/t MaineK00n * Add missing ecosystems, h/t MaineK00n * Add comments why to use custom jar analyzer, h/t MaineK00n * Misc * Misc * Misc * Include go-dep-parser's pares.go for modification * Move digest field from LibraryScanner to Library * Use inner jars sha1 for each * Add Seek to file head before handling zip file entry * Leave Digest feild empty for entries from pom.xml * Don't import python/pkg (don't look into package.json) * Make privete where private is sufficient * Remove duplicate after Java DB lookup * misc * go mod tidy * Comment out ruby/gemspec * misc * Comment out python/packaging * misc * Use custom jar * Update scanner/trivy/jar/parse.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update scanner/trivy/jar/parse.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update scanner/trivy/jar/parse.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update scanner/trivy/jar/parse.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update scanner/trivy/jar/parse.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update scanner/trivy/jar/jar.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update detector/library.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update models/library.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update scanner/base.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update scanner/trivy/jar/parse.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update scanner/trivy/jar/parse.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Missing changes in name change * Update models/github.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update models/library.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update models/library.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update models/library.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update scanner/base.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update scanner/base.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update scanner/trivy/jar/jar.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Don't import fanal/types at github.go * Rewrite code around java db initialization * Add comment * refactor * Close java db client * rename * Let LibraryScanner have java db client * Update detector/library.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update detector/library.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update detector/library.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * Update detector/library.go Co-authored-by: MaineK00n <mainek00n.1229@gmail.com> * inline variable * misc * Fix typo --------- Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>
2024-02-28 14:25:58 +09:00
parent d7e1e82299
commit 351cf4f712
22 changed files with 1600 additions and 318 deletions
--- a/models/github.go
+++ b/models/github.go
@@ -3,8 +3,6 @@ package models
 import (
 	"fmt"
 	"strings"
-
-	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
 )

 // DependencyGraphManifests has a map of DependencyGraphManifest
@@ -30,45 +28,49 @@ func (m DependencyGraphManifest) Ecosystem() string {
 	switch {
 	case strings.HasSuffix(m.Filename, "Cargo.lock"),
 		strings.HasSuffix(m.Filename, "Cargo.toml"):
-		return ftypes.Cargo // Rust
+		return "cargo" // Rust
 	case strings.HasSuffix(m.Filename, "composer.lock"),
 		strings.HasSuffix(m.Filename, "composer.json"):
-		return ftypes.Composer // PHP
+		return "composer" // PHP
 	case strings.HasSuffix(m.Filename, ".csproj"),
 		strings.HasSuffix(m.Filename, ".vbproj"),
 		strings.HasSuffix(m.Filename, ".nuspec"),
 		strings.HasSuffix(m.Filename, ".vcxproj"),
 		strings.HasSuffix(m.Filename, ".fsproj"),
 		strings.HasSuffix(m.Filename, "packages.config"):
-		return ftypes.NuGet // .NET languages (C#, F#, VB), C++
+		return "nuget" // .NET languages (C#, F#, VB), C++
 	case strings.HasSuffix(m.Filename, "go.sum"),
 		strings.HasSuffix(m.Filename, "go.mod"):
-		return ftypes.GoModule // Go
+		return "gomod" // Go
 	case strings.HasSuffix(m.Filename, "pom.xml"):
-		return ftypes.Pom // Java, Scala
+		return "pom" // Java, Scala
 	case strings.HasSuffix(m.Filename, "package-lock.json"),
 		strings.HasSuffix(m.Filename, "package.json"):
-		return ftypes.Npm // JavaScript
+		return "npm" // JavaScript
 	case strings.HasSuffix(m.Filename, "yarn.lock"):
-		return ftypes.Yarn // JavaScript
+		return "yarn" // JavaScript
+	case strings.HasSuffix(m.Filename, "pnpm-lock.yaml"):
+		return "pnpm" // JavaScript
 	case strings.HasSuffix(m.Filename, "requirements.txt"),
 		strings.HasSuffix(m.Filename, "requirements-dev.txt"),
 		strings.HasSuffix(m.Filename, "setup.py"):
-		return ftypes.Pip // Python
+		return "pip" // Python
 	case strings.HasSuffix(m.Filename, "Pipfile.lock"),
 		strings.HasSuffix(m.Filename, "Pipfile"):
-		return ftypes.Pipenv // Python
+		return "pipenv" // Python
 	case strings.HasSuffix(m.Filename, "poetry.lock"),
 		strings.HasSuffix(m.Filename, "pyproject.toml"):
-		return ftypes.Poetry // Python
+		return "poetry" // Python
 	case strings.HasSuffix(m.Filename, "Gemfile.lock"),
 		strings.HasSuffix(m.Filename, "Gemfile"):
-		return ftypes.Bundler // Ruby
+		return "bundler" // Ruby
 	case strings.HasSuffix(m.Filename, ".gemspec"):
-		return ftypes.GemSpec // Ruby
+		return "gemspec" // Ruby
 	case strings.HasSuffix(m.Filename, "pubspec.lock"),
 		strings.HasSuffix(m.Filename, "pubspec.yaml"):
 		return "pub" // Dart
+	case strings.HasSuffix(m.Filename, "Package.resolved"):
+		return "swift" // Swift
 	case strings.HasSuffix(m.Filename, ".yml"),
 		strings.HasSuffix(m.Filename, ".yaml"):
 		return "actions" // GitHub Actions workflows
--- a/models/library.go
+++ b/models/library.go
@@ -1,11 +1,18 @@
 package models

 import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/aquasecurity/go-dep-parser/pkg/java/jar"
 	"github.com/aquasecurity/trivy-db/pkg/db"
 	trivyDBTypes "github.com/aquasecurity/trivy-db/pkg/types"
 	"github.com/aquasecurity/trivy/pkg/detector/library"
 	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
+	"github.com/aquasecurity/trivy/pkg/javadb"
 	"github.com/aquasecurity/trivy/pkg/types"
+	"github.com/samber/lo"
 	"golang.org/x/xerrors"

 	"github.com/future-architect/vuls/logging"
@@ -38,11 +45,13 @@ func (lss LibraryScanners) Total() (total int) {

 // LibraryScanner has libraries information
 type LibraryScanner struct {
-	Type string
+	Type ftypes.LangType
 	Libs []Library

 	// The path to the Lockfile is stored.
 	LockfilePath string `json:"path,omitempty"`
+
+	JavaDBClient *javadb.DB `json:"-"`
 }

 // Library holds the attribute of a package library
@@ -53,19 +62,25 @@ type Library struct {
 	// The Path to the library in the container image. Empty string when Lockfile scan.
 	// This field is used to convert the result JSON of a `trivy image` using trivy-to-vuls.
 	FilePath string
+	Digest   string
 }

 // Scan : scan target library
 func (s LibraryScanner) Scan() ([]VulnInfo, error) {
-	scanner, err := library.NewDriver(s.Type)
-	if err != nil {
-		return nil, xerrors.Errorf("Failed to new a library driver %s: %w", s.Type, err)
+	if s.Type == ftypes.Jar {
+		if err := s.improveJARInfo(); err != nil {
+			return nil, xerrors.Errorf("Failed to improve JAR information by trivy Java DB. err: %w", err)
+		}
+	}
+	scanner, ok := library.NewDriver(s.Type)
+	if !ok {
+		return nil, xerrors.Errorf("Failed to new a library driver for %s", s.Type)
 	}
 	var vulnerabilities = []VulnInfo{}
 	for _, pkg := range s.Libs {
 		tvulns, err := scanner.DetectVulnerabilities("", pkg.Name, pkg.Version)
 		if err != nil {
-			return nil, xerrors.Errorf("failed to detect %s vulnerabilities: %w", scanner.Type(), err)
+			return nil, xerrors.Errorf("Failed to detect %s vulnerabilities. err: %w", scanner.Type(), err)
 		}
 		if len(tvulns) == 0 {
 			continue
@@ -78,6 +93,45 @@ func (s LibraryScanner) Scan() ([]VulnInfo, error) {
 	return vulnerabilities, nil
 }

+func (s *LibraryScanner) improveJARInfo() error {
+	libs := make([]Library, 0, len(s.Libs))
+	for _, l := range s.Libs {
+		if l.Digest == "" {
+			// This is the case from pom.properties, it should be respected as is.
+			libs = append(libs, l)
+			continue
+		}
+
+		algorithm, sha1, found := strings.Cut(l.Digest, ":")
+		if !found || algorithm != "sha1" {
+			logging.Log.Debugf("No SHA1 hash found for %s in the digest: %q", l.FilePath, l.Digest)
+			libs = append(libs, l)
+			continue
+		}
+
+		foundProps, err := s.JavaDBClient.SearchBySHA1(sha1)
+		if err != nil {
+			if !errors.Is(err, jar.ArtifactNotFoundErr) {
+				return xerrors.Errorf("Failed to search trivy Java DB. err: %w", err)
+			}
+
+			logging.Log.Debugf("No record in Java DB for %s by SHA1: %s", l.FilePath, sha1)
+			libs = append(libs, l)
+			continue
+		}
+
+		foundLib := foundProps.Library()
+		l.Name = foundLib.Name
+		l.Version = foundLib.Version
+		libs = append(libs, l)
+	}
+
+	s.Libs = lo.UniqBy(libs, func(lib Library) string {
+		return fmt.Sprintf("%s::%s::%s", lib.Name, lib.Version, lib.FilePath)
+	})
+	return nil
+}
+
 func (s LibraryScanner) convertFanalToVuln(tvulns []types.DetectedVulnerability) (vulns []VulnInfo) {
 	for _, tvuln := range tvulns {
 		vinfo, err := s.getVulnDetail(tvuln)
@@ -131,10 +185,14 @@ func getCveContents(cveID string, vul trivyDBTypes.Vulnerability) (contents map[

 // FindLockFiles is a list of filenames that is the target of findLock
 var FindLockFiles = []string{
+	// dart/pub
+	ftypes.PubSpecLock,
+	// elixir/mix
+	ftypes.MixLock,
 	// node
 	ftypes.NpmPkgLock, ftypes.YarnLock, ftypes.PnpmLock,
 	// ruby
-	ftypes.GemfileLock,
+	ftypes.GemfileLock, "*.gemspec",
 	// rust
 	ftypes.CargoLock,
 	// php
@@ -142,13 +200,15 @@ var FindLockFiles = []string{
 	// python
 	ftypes.PipRequirements, ftypes.PipfileLock, ftypes.PoetryLock,
 	// .net
-	ftypes.NuGetPkgsLock, ftypes.NuGetPkgsConfig, "*.deps.json",
+	ftypes.NuGetPkgsLock, ftypes.NuGetPkgsConfig, "*.deps.json", "*Packages.props",
 	// gomod
 	ftypes.GoMod, ftypes.GoSum,
 	// java
 	ftypes.MavenPom, "*.jar", "*.war", "*.ear", "*.par", "*gradle.lockfile",
 	// C / C++
 	ftypes.ConanLock,
+	// Swift
+	ftypes.CocoaPodsLock, ftypes.SwiftResolved,
 }

 // GetLibraryKey returns target library key
@@ -156,7 +216,7 @@ func (s LibraryScanner) GetLibraryKey() string {
 	switch s.Type {
 	case ftypes.Bundler, ftypes.GemSpec:
 		return "ruby"
-	case ftypes.Cargo:
+	case ftypes.Cargo, ftypes.RustBinary:
 		return "rust"
 	case ftypes.Composer:
 		return "php"
@@ -170,8 +230,14 @@ func (s LibraryScanner) GetLibraryKey() string {
 		return ".net"
 	case ftypes.Pipenv, ftypes.Poetry, ftypes.Pip, ftypes.PythonPkg:
 		return "python"
-	case ftypes.ConanLock:
+	case ftypes.Conan:
 		return "c"
+	case ftypes.Pub:
+		return "dart"
+	case ftypes.Hex:
+		return "elixir"
+	case ftypes.Swift, ftypes.Cocoapods:
+		return "swift"
 	default:
 		return ""
 	}