Skip to content

Trivy Parser Creates Malformed Location URL #2324

@danil-smirnov

Description

@danil-smirnov

🐞 Bug report

Describe the bug

We do the following scan by Trivy:

apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
  name: "trivy-k8s-1"
  annotations:
    defectdojo.securecodebox.io/product-type-name: Infra
    defectdojo.securecodebox.io/product-name: infra-cluster
    defectdojo.securecodebox.io/engagement-name: "Trivy k8s scan"
    defectdojo.securecodebox.io/test-title: "Trivy k8s weekly scan"
spec:
  scanType: "trivy-k8s"
  parameters:
    - "-d"
    - "--timeout"
    - "30m"
    - "--tolerations"
    - "gitlab_runners=true:NoSchedule"
    - "--components"
    - "workload"
    - "--scanners"
    - "vuln"
    - "-n"
    - "gitlab"
    - "pods"
  volumes:
    - name: dockersocket
      hostPath:
        path: /run/containerd/containerd.sock
    - name: db-cache
      persistentVolumeClaim:
        claimName: trivy-k8s-database
  volumeMounts:
    - name: dockersocket
      mountPath: /run/containerd/containerd.sock
    - name: db-cache
      mountPath: /root/.cache/trivy

Scan and parse stages go just fine. But in the Persistence-defectdojo hook we see a lot of warnings like this:

2024-02-29 17:17:26 WARN  SecureCodeBoxFindingsToDefectDojoMapper:89 - Couldn't parse the secureCodeBox location, because it: java.lang.IllegalArgumentException: Illegal character in opaque part at index 10: Namespace: 'gitlab' / Kind: 'Pod' / Name: 'runner--ykq-n2m-project-8-concurrent-0-na4oov1f' is not a vailid uri: Namespace: 'gitlab' / Kind: 'Pod' / Name: 'runner--ykq-n2m-project-8-concurrent-0-na4oov1f'
2024-02-29 17:17:26 WARN  SecureCodeBoxFindingsToDefectDojoMapper:89 - Couldn't parse the secureCodeBox location, because it: java.lang.IllegalArgumentException: Illegal character in opaque part at index 10: Namespace: 'gitlab' / Kind: 'Pod' / Name: 'runner--ykq-n2m-project-8-concurrent-0-na4oov1f' is not a vailid uri: Namespace: 'gitlab' / Kind: 'Pod' / Name: 'runner--ykq-n2m-project-8-concurrent-0-na4oov1f'

Steps To Reproduce

Expected behavior

System (please complete the following information):

  • operator-4.4.0
  • trivy-4.4.1
  • persistence-defectdojo-4.4.1

Screenshots / Logs

Additional context

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions