fix(license): add license handling to JUnit template #7409

psibre · 2024-08-27T16:28:39Z

Description

Related issues

Close Add JUnit report support for license scanning #7408

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

psibre · 2024-08-29T15:06:59Z

Preliminaries

psibre@go:~/trivy$ git worktree list
/home/psibre/trivy                     c96dcdd44 [main]
/home/psibre/trivy/fix-junit-template  2def603bf [psibre/fix-add-license-handling-to-junit-template]

psibre@go:~/trivy$ ./trivy version
2024/08/29 14:52:24 WARN Check ID is empty file_path=lib/docker/docker.rego
Version: 0.54.0-52-gc96dcdd44

I've created a Java project to produce a suitable SBOM specimen (see psibre/java-app-vuln-license-sbom-mwe@df7dc92), which I'll attach here for convenience:

sbom.json

Vulnerability scanner

Table format

psibre@go:~/trivy$ ./trivy sbom --quiet --scanners vuln sbom.json 
2024/08/29 14:56:24 WARN Check ID is empty file_path=lib/docker/docker.rego

Java (jar)

Total: 14 (UNKNOWN: 0, LOW: 0, MEDIUM: 5, HIGH: 7, CRITICAL: 2)

┌───────────────────────────────────┬────────────────┬──────────┬──────────┬───────────────────┬────────────────────────────────┬──────────────────────────────────────────────────────────────┐
│              Library              │ Vulnerability  │ Severity │  Status  │ Installed Version │         Fixed Version          │                            Title                             │
├───────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ com.google.protobuf:protobuf-java │ CVE-2021-22569 │ HIGH     │ fixed    │ 3.11.4            │ 3.16.1, 3.18.2, 3.19.2         │ protobuf-java: potential DoS in the parsing procedure for    │
│                                   │                │          │          │                   │                                │ binary data                                                  │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2021-22569                   │
│                                   ├────────────────┤          │          │                   ├────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                   │ CVE-2021-22570 │          │          │                   │ 3.15.0                         │ protobuf: Incorrect parsing of nullchar in the proto symbol  │
│                                   │                │          │          │                   │                                │ leads to Nullptr...                                          │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2021-22570                   │
│                                   ├────────────────┤          │          │                   ├────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                   │ CVE-2022-3509  │          │          │                   │ 3.16.3, 3.19.6, 3.20.3, 3.21.7 │ protobuf-java: Textformat parsing issue leads to DoS         │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2022-3509                    │
│                                   ├────────────────┤          │          │                   │                                ├──────────────────────────────────────────────────────────────┤
│                                   │ CVE-2022-3510  │          │          │                   │                                │ protobuf-java: Message-Type Extensions parsing issue leads   │
│                                   │                │          │          │                   │                                │ to DoS                                                       │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2022-3510                    │
│                                   ├────────────────┼──────────┤          │                   ├────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                   │ CVE-2022-3171  │ MEDIUM   │          │                   │ 3.21.7, 3.20.3, 3.19.6, 3.16.3 │ protobuf-java: timeout in parser leads to DoS                │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2022-3171                    │
├───────────────────────────────────┼────────────────┼──────────┤          ├───────────────────┼────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ edu.stanford.nlp:stanford-corenlp │ CVE-2021-44550 │ CRITICAL │          │ 4.3.2             │ 4.4.0                          │ Access Control vulnerability within CoreNLP                  │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2021-44550                   │
│                                   ├────────────────┤          ├──────────┤                   ├────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                   │ CVE-2022-0239  │          │ affected │                   │                                │ corenlp is vulnerable to Improper Restriction of XML         │
│                                   │                │          │          │                   │                                │ External Entity Reference                                    │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2022-0239                    │
│                                   ├────────────────┼──────────┤          │                   ├────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                   │ CVE-2022-0198  │ MEDIUM   │          │                   │                                │ XML External Entity Reference in                             │
│                                   │                │          │          │                   │                                │ edu.stanford.nlp:stanford-corenlp                            │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2022-0198                    │
├───────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ xalan:xalan                       │ CVE-2022-34169 │ HIGH     │ fixed    │ 2.7.2             │ 2.7.3                          │ OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2022-34169                   │
├───────────────────────────────────┼────────────────┤          │          ├───────────────────┼────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ xerces:xercesImpl                 │ CVE-2012-0881  │          │          │ 2.8.0             │ 2.12.0                         │ xml: xerces-j2 hash table collisions CPU usage DoS           │
│                                   │                │          │          │                   │                                │ (oCERT-2011-003)                                             │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2012-0881                    │
│                                   ├────────────────┤          │          │                   │                                ├──────────────────────────────────────────────────────────────┤
│                                   │ CVE-2013-4002  │          │          │                   │                                │ OpenJDK: XML parsing Denial of Service (JAXP, 8017298)       │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2013-4002                    │
│                                   ├────────────────┼──────────┤          │                   ├────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                   │ CVE-2009-2625  │ MEDIUM   │          │                   │ 2.10.0                         │ JDK: XML parsing Denial-Of-Service (6845701)                 │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2009-2625                    │
│                                   ├────────────────┤          │          │                   ├────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                   │ CVE-2020-14338 │          │          │                   │ 2.12.0.sp3                     │ wildfly: XML validation manipulation due to incomplete       │
│                                   │                │          │          │                   │                                │ application of use-grammar-pool-only in xercesImpl...        │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2020-14338                   │
│                                   ├────────────────┤          │          │                   ├────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                   │ CVE-2022-23437 │          │          │                   │ 2.12.2                         │ xerces-j2: infinite loop when handling specially crafted XML │
│                                   │                │          │          │                   │                                │ document payloads                                            │
│                                   │                │          │          │                   │                                │ https://avd.aquasec.com/nvd/cve-2022-23437                   │
└───────────────────────────────────┴────────────────┴──────────┴──────────┴───────────────────┴────────────────────────────────┴──────────────────────────────────────────────────────────────┘

JUnit XML format

contrib/junit.tplpsibre@go:~/trivy$ ./trivy sbom --quiet --scanners vuln --format template \
  --template @contrib/junit.tpl sbom.json 
2024/08/29 15:00:08 WARN Check ID is empty file_path=lib/docker/docker.rego

<?xml version="1.0" ?>
<testsuites name="trivy">
    <testsuite tests="14" failures="14" name="Java" errors="0" skipped="0" time="">
        <properties>
            <property name="type" value="jar"></property>
        </properties>
        <testcase classname="com.google.protobuf:protobuf-java-3.11.4" name="[HIGH] CVE-2021-22569" time="">
            <failure message="protobuf-java: potential DoS in the parsing procedure for binary data" type="description">An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.</failure>
        </testcase>
        <testcase classname="com.google.protobuf:protobuf-java-3.11.4" name="[HIGH] CVE-2021-22570" time="">
            <failure message="protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference" type="description">Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file&#39;s name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.</failure>
        </testcase>
        <testcase classname="com.google.protobuf:protobuf-java-3.11.4" name="[HIGH] CVE-2022-3509" time="">
            <failure message="protobuf-java: Textformat parsing issue leads to DoS" type="description">A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.</failure>
        </testcase>
        <testcase classname="com.google.protobuf:protobuf-java-3.11.4" name="[HIGH] CVE-2022-3510" time="">
            <failure message="protobuf-java: Message-Type Extensions parsing issue leads to DoS" type="description">A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.&#xA;&#xA;</failure>
        </testcase>
        <testcase classname="com.google.protobuf:protobuf-java-3.11.4" name="[MEDIUM] CVE-2022-3171" time="">
            <failure message="protobuf-java: timeout in parser leads to DoS" type="description">A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.</failure>
        </testcase>
        <testcase classname="edu.stanford.nlp:stanford-corenlp-4.3.2" name="[CRITICAL] CVE-2021-44550" time="">
            <failure message="Access Control vulnerability within CoreNLP" type="description">An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).</failure>
        </testcase>
        <testcase classname="edu.stanford.nlp:stanford-corenlp-4.3.2" name="[CRITICAL] CVE-2022-0239" time="">
            <failure message="corenlp is vulnerable to Improper Restriction of XML External Entity Reference" type="description">corenlp is vulnerable to Improper Restriction of XML External Entity Reference</failure>
        </testcase>
        <testcase classname="edu.stanford.nlp:stanford-corenlp-4.3.2" name="[MEDIUM] CVE-2022-0198" time="">
            <failure message="XML External Entity Reference in edu.stanford.nlp:stanford-corenlp" type="description">corenlp is vulnerable to Improper Restriction of XML External Entity Reference</failure>
        </testcase>
        <testcase classname="xalan:xalan-2.7.2" name="[HIGH] CVE-2022-34169" time="">
            <failure message="OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407)" type="description">The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.</failure>
        </testcase>
        <testcase classname="xerces:xercesImpl-2.8.0" name="[HIGH] CVE-2012-0881" time="">
            <failure message="xml: xerces-j2 hash table collisions CPU usage DoS (oCERT-2011-003)" type="description">Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.</failure>
        </testcase>
        <testcase classname="xerces:xercesImpl-2.8.0" name="[HIGH] CVE-2013-4002" time="">
            <failure message="OpenJDK: XML parsing Denial of Service (JAXP, 8017298)" type="description">XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.</failure>
        </testcase>
        <testcase classname="xerces:xercesImpl-2.8.0" name="[MEDIUM] CVE-2009-2625" time="">
            <failure message="JDK: XML parsing Denial-Of-Service (6845701)" type="description">XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.</failure>
        </testcase>
        <testcase classname="xerces:xercesImpl-2.8.0" name="[MEDIUM] CVE-2020-14338" time="">
            <failure message="wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl" type="description">A flaw was found in Wildfly&#39;s implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the &#34;use-grammar-pool-only&#34; feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.</failure>
        </testcase>
        <testcase classname="xerces:xercesImpl-2.8.0" name="[MEDIUM] CVE-2022-23437" time="">
            <failure message="xerces-j2: infinite loop when handling specially crafted XML document payloads" type="description">There&#39;s a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.</failure>
        </testcase>
    </testsuite>
    <testsuite tests="0" failures="0" name="Java" errors="0" skipped="0" time="">
        <properties>
            <property name="type" value="jar"></property>
        </properties>
    </testsuite>
</testsuites>

License scanner

Table format

psibre@go:~/trivy$ ./trivy sbom --quiet --scanners license sbom.json 
2024/08/29 15:02:27 WARN Check ID is empty file_path=lib/docker/docker.rego

Java (license)

Total: 30 (UNKNOWN: 3, LOW: 23, MEDIUM: 3, HIGH: 1, CRITICAL: 0)

┌───────────────────────────────────────────┬────────────────────────────────────────────────────┬────────────────┬──────────┐
│                  Package                  │                      License                       │ Classification │ Severity │
├───────────────────────────────────────────┼────────────────────────────────────────────────────┼────────────────┼──────────┤
│ com.apple:AppleJavaExtensions             │ Apple License                                      │ Non Standard   │ UNKNOWN  │
├───────────────────────────────────────────┼────────────────────────────────────────────────────┼────────────────┼──────────┤
│ com.google.code.findbugs:jsr305           │ Apache-2.0                                         │ Notice         │ LOW      │
├───────────────────────────────────────────┼────────────────────────────────────────────────────┤                │          │
│ com.google.protobuf:protobuf-java         │ BSD-3-Clause                                       │                │          │
├───────────────────────────────────────────┼────────────────────────────────────────────────────┼────────────────┼──────────┤
│ com.sun.xml.bind:jaxb-core                │ CDDL-1.1                                           │ Reciprocal     │ MEDIUM   │
├───────────────────────────────────────────┤                                                    │                │          │
│ com.sun.xml.bind:jaxb-impl                │                                                    │                │          │
├───────────────────────────────────────────┼────────────────────────────────────────────────────┼────────────────┼──────────┤
│ de.jollyday:jollyday                      │ Apache-2.0                                         │ Notice         │ LOW      │
├───────────────────────────────────────────┼────────────────────────────────────────────────────┼────────────────┼──────────┤
│ edu.stanford.nlp:stanford-corenlp         │ GNU General Public License Version 3               │ Non Standard   │ UNKNOWN  │
├───────────────────────────────────────────┼────────────────────────────────────────────────────┼────────────────┼──────────┤
│ javax.xml.bind:jaxb-api                   │ CDDL-1.1                                           │ Reciprocal     │ MEDIUM   │
│                                           ├────────────────────────────────────────────────────┼────────────────┼──────────┤
│                                           │ GPL-2.0-with-classpath-exception                   │ Restricted     │ HIGH     │
├───────────────────────────────────────────┼────────────────────────────────────────────────────┼────────────────┼──────────┤
│ joda-time:joda-time                       │ Apache-2.0                                         │ Notice         │ LOW      │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.apache.commons:commons-lang3          │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.apache.lucene:lucene-analyzers-common │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.apache.lucene:lucene-core             │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.apache.lucene:lucene-queries          │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.apache.lucene:lucene-queryparser      │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.apache.lucene:lucene-sandbox          │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.ejml:ejml-cdense                      │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.ejml:ejml-core                        │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.ejml:ejml-ddense                      │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.ejml:ejml-dsparse                     │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.ejml:ejml-fdense                      │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.ejml:ejml-fsparse                     │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.ejml:ejml-simple                      │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ org.ejml:ejml-zdense                      │                                                    │                │          │
├───────────────────────────────────────────┼────────────────────────────────────────────────────┤                │          │
│ org.slf4j:slf4j-api                       │ MIT                                                │                │          │
├───────────────────────────────────────────┼────────────────────────────────────────────────────┤                │          │
│ xalan:serializer                          │ Apache-2.0                                         │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ xalan:xalan                               │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ xerces:xercesImpl                         │                                                    │                │          │
├───────────────────────────────────────────┤                                                    │                │          │
│ xml-apis:xml-apis                         │                                                    │                │          │
├───────────────────────────────────────────┼────────────────────────────────────────────────────┼────────────────┼──────────┤
│ xom:xom                                   │ The GNU Lesser General Public License, Version 2.1 │ Non Standard   │ UNKNOWN  │
└───────────────────────────────────────────┴────────────────────────────────────────────────────┴────────────────┴──────────┘

JUnit XML format (before)

psibre@go:~/trivy$ ./trivy sbom --quiet --scanners license --format template \
  --template @contrib/junit.tpl sbom.json 
2024/08/29 15:03:37 WARN Check ID is empty file_path=lib/docker/docker.rego

<?xml version="1.0" ?>
<testsuites name="trivy">
    <testsuite tests="0" failures="0" name="OS Packages" errors="0" skipped="0" time="">
    </testsuite>
    <testsuite tests="0" failures="0" name="OS Packages" errors="0" skipped="0" time="">
    </testsuite>
    <testsuite tests="0" failures="0" name="Java" errors="0" skipped="0" time="">
    </testsuite>
    <testsuite tests="0" failures="0" name="Java" errors="0" skipped="0" time="">
    </testsuite>
    <testsuite tests="0" failures="0" name="Loose File License(s)" errors="0" skipped="0" time="">
    </testsuite>
    <testsuite tests="0" failures="0" name="Loose File License(s)" errors="0" skipped="0" time="">
    </testsuite>
</testsuites>

JUnit XML format (after)

psibre@go:~/trivy$ ./trivy sbom --quiet --scanners license --format template \
  --template @fix-junit-template/contrib/junit.tpl sbom.json 
2024/08/29 15:04:34 WARN Check ID is empty file_path=lib/docker/docker.rego

<?xml version="1.0" ?>
<testsuites name="trivy">
    <testsuite tests="0" failures="0" name="OS Packages" errors="0" skipped="0" time="">
    </testsuite>
    <testsuite tests="0" failures="0" name="OS Packages" errors="0" skipped="0" time="">
    </testsuite>
    <testsuite tests="0" failures="0" name="Java" errors="0" skipped="0" time="">
    </testsuite>
    <testsuite tests="30" failures="30" name="Java" time="0">
        <testcase classname="com.apple:AppleJavaExtensions" name="[UNKNOWN] Apple License">
            <failure/>
        </testcase>
        <testcase classname="com.google.code.findbugs:jsr305" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="com.google.protobuf:protobuf-java" name="[LOW] BSD-3-Clause">
            <failure/>
        </testcase>
        <testcase classname="com.sun.xml.bind:jaxb-core" name="[MEDIUM] CDDL-1.1">
            <failure/>
        </testcase>
        <testcase classname="com.sun.xml.bind:jaxb-impl" name="[MEDIUM] CDDL-1.1">
            <failure/>
        </testcase>
        <testcase classname="de.jollyday:jollyday" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="edu.stanford.nlp:stanford-corenlp" name="[UNKNOWN] GNU General Public License Version 3">
            <failure/>
        </testcase>
        <testcase classname="javax.xml.bind:jaxb-api" name="[MEDIUM] CDDL-1.1">
            <failure/>
        </testcase>
        <testcase classname="javax.xml.bind:jaxb-api" name="[HIGH] GPL-2.0-with-classpath-exception">
            <failure/>
        </testcase>
        <testcase classname="joda-time:joda-time" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.apache.commons:commons-lang3" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.apache.lucene:lucene-analyzers-common" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.apache.lucene:lucene-core" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.apache.lucene:lucene-queries" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.apache.lucene:lucene-queryparser" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.apache.lucene:lucene-sandbox" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.ejml:ejml-cdense" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.ejml:ejml-core" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.ejml:ejml-ddense" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.ejml:ejml-dsparse" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.ejml:ejml-fdense" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.ejml:ejml-fsparse" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.ejml:ejml-simple" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.ejml:ejml-zdense" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="org.slf4j:slf4j-api" name="[LOW] MIT">
            <failure/>
        </testcase>
        <testcase classname="xalan:serializer" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="xalan:xalan" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="xerces:xercesImpl" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="xml-apis:xml-apis" name="[LOW] Apache-2.0">
            <failure/>
        </testcase>
        <testcase classname="xom:xom" name="[UNKNOWN] The GNU Lesser General Public License, Version 2.1">
            <failure/>
        </testcase>
    </testsuite>
    <testsuite tests="0" failures="0" name="Java" errors="0" skipped="0" time="">
    </testsuite>
    <testsuite tests="0" failures="0" name="Loose File License(s)" errors="0" skipped="0" time="">
    </testsuite>
    <testsuite tests="0" failures="0" name="Loose File License(s)" errors="0" skipped="0" time="">
    </testsuite>
</testsuites>

psibre · 2024-08-29T15:38:38Z

Perhaps it would be even more useful to add the <failure/> only when the severity is higher than LOW or MEDIUM, but that would essentially hard-code the policy threshold...

knqyf263 · 2024-08-30T07:30:15Z

@afdesk Can you please take a look?

afdesk · 2024-08-30T11:05:46Z

@psibre thanks a lot for your contribution! it's really nice.

Should License block be after Misconfiguration block?
wdyt?

contrib/junit.tpl

afdesk · 2024-08-30T11:08:50Z

Also about JUnit template.
It's a little confusing to me:

I mean a pattern [License severity] License name inside name field.

but this logic is for all blocks...

psibre · 2024-08-30T11:51:13Z

Also about JUnit template. It's a little confusing to me:
I mean a pattern [License severity] License name inside name field.

but this logic is for all blocks...

I based this pattern on the one already present in the Vulnerabilities portion of the template. Specifically, in junit.tpl#L12, there is

<testcase classname="{{ .PkgName }}-{{ .InstalledVersion }}" name="[{{ .Vulnerability.Severity }}] {{ .VulnerabilityID }}" time="">

Since that name attribute is typically part of the summary (e.g., in a GitLab test report), I think it's consistent with expected behavior of Trivy-generated JUnit XML reports to maintain that pattern for the licenses.

afdesk · 2024-08-30T12:34:10Z

I based this pattern on the one already present in the Vulnerabilities portion of the template.

i understand it. thanks!

contrib/junit.tpl

* feat(vm): Support direct filesystem (aquasecurity#7058) Signed-off-by: yusuke.koyoshi <[email protected]> * feat(cli)!: delete deprecated SBOM flags (aquasecurity#7266) Signed-off-by: knqyf263 <[email protected]> * feat(vm): support the Ext2/Ext3 filesystems (aquasecurity#6983) * fix(plugin): do not call GitHub content API for releases and tags (aquasecurity#7274) Signed-off-by: knqyf263 <[email protected]> * fix(java): Return error when trying to find a remote pom to avoid segfault (aquasecurity#7275) Co-authored-by: DmitriyLewen <[email protected]> * fix(flag): incorrect behavior for deprected flag `--clear-cache` (aquasecurity#7281) * refactor(misconf): remove file filtering from parsers (aquasecurity#7289) Signed-off-by: nikpivkin <[email protected]> * feat(vuln): Add `--detection-priority` flag for accuracy tuning (aquasecurity#7288) Signed-off-by: knqyf263 <[email protected]> * docs: add auto-generated config (aquasecurity#7261) Signed-off-by: knqyf263 <[email protected]> Co-authored-by: knqyf263 <[email protected]> * fix(terraform): add aws_region name to presets (aquasecurity#7184) * perf(misconf): do not convert contents of a YAML file to string (aquasecurity#7292) Signed-off-by: nikpivkin <[email protected]> * refactor(misconf): remove unused universal scanner (aquasecurity#7293) Signed-off-by: nikpivkin <[email protected]> * perf(misconf): use json.Valid to check validity of JSON (aquasecurity#7308) Signed-off-by: nikpivkin <[email protected]> * fix(misconf): load only submodule if it is specified in source (aquasecurity#7112) Signed-off-by: nikpivkin <[email protected]> * feat(misconf): support for policy and bucket grants (aquasecurity#7284) Signed-off-by: nikpivkin <[email protected]> * fix(misconf): do not set default value for default_cache_behavior (aquasecurity#7234) Signed-off-by: nikpivkin <[email protected]> * feat(misconf): iterator argument support for dynamic blocks (aquasecurity#7236) Signed-off-by: nikpivkin <[email protected]> Co-authored-by: simar7 <[email protected]> * chore(deps): bump the common group across 1 directory with 7 updates (aquasecurity#7305) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs: update client/server docs for misconf and license scanning (aquasecurity#7277) Signed-off-by: nikpivkin <[email protected]> Signed-off-by: knqyf263 <[email protected]> Co-authored-by: knqyf263 <[email protected]> * docs: update links to packaging.python.org (aquasecurity#7318) Signed-off-by: nikpivkin <[email protected]> * perf(misconf): optimize work with context (aquasecurity#6968) Signed-off-by: nikpivkin <[email protected]> * refactor: replace ftypes.Gradle with packageurl.TypeGradle (aquasecurity#7323) Signed-off-by: nikpivkin <[email protected]> * docs: update air-gapped docs (aquasecurity#7160) Signed-off-by: knqyf263 <[email protected]> Co-authored-by: knqyf263 <[email protected]> * docs(misconf): Update callsites to use correct naming (aquasecurity#7335) * chore(deps): bump the common group with 9 updates (aquasecurity#7333) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(misconf): change default TLS values for the Azure storage account (aquasecurity#7345) Signed-off-by: nikpivkin <[email protected]> * refactor(misconf): highlight only affected rows (aquasecurity#7310) Signed-off-by: nikpivkin <[email protected]> * fix(misconf): wrap Azure PortRange in iac types (aquasecurity#7357) Signed-off-by: nikpivkin <[email protected]> * feat(misconf): scanning support for YAML and JSON (aquasecurity#7311) Signed-off-by: nikpivkin <[email protected]> * feat(misconf): variable support for Terraform Plan (aquasecurity#7228) Signed-off-by: nikpivkin <[email protected]> * fix: safely check if the directory exists (aquasecurity#7353) Signed-off-by: nikpivkin <[email protected]> * chore(deps): bump the aws group across 1 directory with 7 updates (aquasecurity#7358) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(server): add internal `--path-prefix` flag for client/server mode (aquasecurity#7321) Signed-off-by: knqyf263 <[email protected]> * chore(deps): bump trivy-checks (aquasecurity#7350) Signed-off-by: nikpivkin <[email protected]> * refactor(misconf): use slog (aquasecurity#7295) Signed-off-by: nikpivkin <[email protected]> * feat(misconf): ignore duplicate checks (aquasecurity#7317) Signed-off-by: nikpivkin <[email protected]> * fix(misconf): init frameworks before updating them (aquasecurity#7376) Signed-off-by: nikpivkin <[email protected]> * fix(misconf): support deprecating for Go checks (aquasecurity#7377) Signed-off-by: nikpivkin <[email protected]> * feat(python): use minimum version for pip packages (aquasecurity#7348) * docs: add pkg flags to config file page (aquasecurity#7370) * feat(misconf): Add support for using spec from on-disk bundle (aquasecurity#7179) * fix(report): escape `Message` field in `asff.tpl` template (aquasecurity#7401) * fix(misconf): use module to log when metadata retrieval fails (aquasecurity#7405) Signed-off-by: nikpivkin <[email protected]> * feat(misconf): support for ignore by nested attributes (aquasecurity#7205) Signed-off-by: nikpivkin <[email protected]> * fix(misconf): do not filter Terraform plan JSON by name (aquasecurity#7406) Signed-off-by: nikpivkin <[email protected]> * feat(misconf): port and protocol support for EC2 networks (aquasecurity#7146) Signed-off-by: nikpivkin <[email protected]> * chore: fix allow rule of ignoring test files to make it case insensitive (aquasecurity#7415) * fix(secret): use only line with secret for long secret lines (aquasecurity#7412) * chore: update CODEOWNERS (aquasecurity#7398) Signed-off-by: knqyf263 <[email protected]> * feat(server): Make Trivy Server Multiplexer Exported (aquasecurity#7389) * feat(report): export modified findings in JSON (aquasecurity#7383) Signed-off-by: knqyf263 <[email protected]> * fix(sbom): use `NOASSERTION` for licenses fields in SPDX formats (aquasecurity#7403) * fix(misconf): do not register Rego libs in checks registry (aquasecurity#7420) Signed-off-by: nikpivkin <[email protected]> * chore(deps): Bump trivy-checks (aquasecurity#7417) Signed-off-by: nikpivkin <[email protected]> Co-authored-by: nikpivkin <[email protected]> * fix(misconf): do not recreate filesystem map (aquasecurity#7416) Signed-off-by: nikpivkin <[email protected]> * fix(secret): use `.eyJ` keyword for JWT secret (aquasecurity#7410) * fix(misconf): fix infer type for null value (aquasecurity#7424) Signed-off-by: nikpivkin <[email protected]> * fix(aws): handle ECR repositories in different regions (aquasecurity#6217) Signed-off-by: Kevin Conner <[email protected]> * fix: logger initialization before flags parsing (aquasecurity#7372) Signed-off-by: knqyf263 <[email protected]> Co-authored-by: knqyf263 <[email protected]> * fix(nodejs): check all `importers` to detect dev deps from pnpm-lock.yaml file (aquasecurity#7387) * test: add integration plugin tests (aquasecurity#7299) * feat(sbom): set User-Agent header on requests to Rekor (aquasecurity#7396) Signed-off-by: Bob Callaway <[email protected]> * fix(helm): explicitly define `kind` and `apiVersion` of `volumeClaimTemplate` element (aquasecurity#7362) * chore(deps): Bump trivy-checks and pin OPA (aquasecurity#7427) Signed-off-by: nikpivkin <[email protected]> Co-authored-by: nikpivkin <[email protected]> * feat(java): add `test` scope support for `pom.xml` files (aquasecurity#7414) * fix(license): add license handling to JUnit template (aquasecurity#7409) * feat(go): use `toolchain` as `stdlib` version for `go.mod` files (aquasecurity#7163) * release: v0.55.0 [main] (aquasecurity#7271) * fix(license): stop spliting a long license text (aquasecurity#7336) Signed-off-by: knqyf263 <[email protected]> Co-authored-by: knqyf263 <[email protected]> * refactor(java): add error/statusCode for logs when we can't get pom.xml/maven-metadata.xml from remote repo (aquasecurity#7451) * chore(helm): bump up Trivy Helm chart (aquasecurity#7441) * chore(deps): bump the common group across 1 directory with 19 updates (aquasecurity#7436) Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: knqyf263 <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: knqyf263 <[email protected]> * chore(deps): bump the aws group with 6 updates (aquasecurity#7468) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(oracle): Update EOL date for Oracle 7 (aquasecurity#7480) * fix(report): change a receiver of MarshalJSON (aquasecurity#7483) Signed-off-by: knqyf263 <[email protected]> * fix(report): fix error with unmarshal of `ExperimentalModifiedFindings` (aquasecurity#7463) Signed-off-by: knqyf263 <[email protected]> Co-authored-by: knqyf263 <[email protected]> * docs(oci): Add a note About the expected Media Type for the Trivy-DB OCI Artifact (aquasecurity#7449) * feat(license): improve license normalization (aquasecurity#7131) Signed-off-by: knqyf263 <[email protected]> Co-authored-by: DmitriyLewen <[email protected]> Co-authored-by: knqyf263 <[email protected]> * docs(db): add a manifest example (aquasecurity#7485) Signed-off-by: knqyf263 <[email protected]> * revert(java): stop supporting of `test` scope for `pom.xml` files (aquasecurity#7488) * docs: refine go docs (aquasecurity#7442) Signed-off-by: knqyf263 <[email protected]> Co-authored-by: knqyf263 <[email protected]> * chore(vex): suppress openssl vulnerabilities (aquasecurity#7500) Signed-off-by: knqyf263 <[email protected]> * chore(deps): bump alpine from 3.20.0 to 3.20.3 (aquasecurity#7508) * chore(vex): add `CVE-2024-34155`, `CVE-2024-34156` and `CVE-2024-34158` in `trivy.openvex.json` (aquasecurity#7510) * fix(java): use `dependencyManagement` from root/child pom's for dependencies from parents (aquasecurity#7497) * refactor: split `.egg` and `packaging` analyzers (aquasecurity#7514) * feat(misconf): Register checks only when needed (aquasecurity#7435) * fix(misconf): Fix logging typo (aquasecurity#7473) * chore(deps): bump go-ebs-file (aquasecurity#7513) Signed-off-by: nikpivkin <[email protected]> * fix(sbom): parse type `framework` as `library` when unmarshalling `CycloneDX` files (aquasecurity#7527) * refactor(misconf): pass options to Rego scanner as is (aquasecurity#7529) Signed-off-by: nikpivkin <[email protected]> * fix(sbom): export bom-ref when converting a package to a component (aquasecurity#7340) Signed-off-by: knqyf263 <[email protected]> Co-authored-by: amf <[email protected]> Co-authored-by: knqyf263 <[email protected]> * perf(misconf): use port ranges instead of enumeration (aquasecurity#7549) Signed-off-by: nikpivkin <[email protected]> * fix(misconf): Fixed scope for China Cloud (aquasecurity#7560) * docs(misconf): Add more info on how to use arbitrary JSON/YAML scan feat (aquasecurity#7458) * chore(deps): remove broken replaces for opa and discovery (aquasecurity#7600) * ci: cache test images for `integration`, `VM` and `module` tests (aquasecurity#7599) * ci: add `workflow_dispatch` trigger for test workflow. (aquasecurity#7606) * chore(deps): bump the common group across 1 directory with 20 updates (aquasecurity#7604) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: knqyf263 <[email protected]> * fix(db): check `DownloadedAt` for `trivy-java-db` (aquasecurity#7592) * fix: allow access to '..' in mapfs (aquasecurity#7575) Signed-off-by: nikpivkin <[email protected]> * test: use a local registry for remote scanning (aquasecurity#7607) Signed-off-by: knqyf263 <[email protected]> * fix(misconf): escape all special sequences (aquasecurity#7558) Signed-off-by: nikpivkin <[email protected]> * feat(misconf): add ability to disable checks by ID (aquasecurity#7536) Signed-off-by: nikpivkin <[email protected]> Co-authored-by: Simar <[email protected]> * feat(suse): added SUSE Linux Enterprise Micro support (aquasecurity#7294) Signed-off-by: Marcus Meissner <[email protected]> Signed-off-by: knqyf263 <[email protected]> Co-authored-by: knqyf263 <[email protected]> * fix(misconf): disable DS016 check for image history analyzer (aquasecurity#7540) Signed-off-by: nikpivkin <[email protected]> * ci: split `save` and `restore` cache actions (aquasecurity#7614) * refactor: fix auth error handling (aquasecurity#7615) Signed-off-by: knqyf263 <[email protected]> * feat(secret): enhance secret scanning for python binary files (aquasecurity#7223) Signed-off-by: knqyf263 <[email protected]> Co-authored-by: knqyf263 <[email protected]> * feat(java): add empty versions if `pom.xml` dependency versions can't be detected (aquasecurity#7520) Co-authored-by: Teppei Fukuda <[email protected]> * test: use loaded image names (aquasecurity#7617) Signed-off-by: knqyf263 <[email protected]> * ci: don't use cache for `setup-go` (aquasecurity#7622) * feat: support multiple DB repositories for vulnerability and Java DB (aquasecurity#7605) Signed-off-by: nikpivkin <[email protected]> * feat(misconf): Support `--skip-*` for all included modules (aquasecurity#7579) Signed-off-by: nikpivkin <[email protected]> Co-authored-by: nikpivkin <[email protected]> * chore: add prefixes to log messages (aquasecurity#7625) Signed-off-by: knqyf263 <[email protected]> Co-authored-by: simar7 <[email protected]> * fix(misconf): Disable deprecated checks by default (aquasecurity#7632) * chore(deps): Bump trivy-checks to v1.1.0 (aquasecurity#7631) * fix(secret): change grafana token regex to find them without unquoted (aquasecurity#7627) * feat: support RPM archives (aquasecurity#7628) Signed-off-by: knqyf263 <[email protected]> * fix(misconf): not to warn about missing selectors of libraries (aquasecurity#7638) Signed-off-by: nikpivkin <[email protected]> * release: v0.56.0 [main] (aquasecurity#7447) * fix(db): fix javadb downloading error handling [backport: release/v0.56] (aquasecurity#7646) Signed-off-by: nikpivkin <[email protected]> Co-authored-by: Nikita Pivkin <[email protected]> * release: v0.56.1 [release/v0.56] (aquasecurity#7648) * fix(sbom): add options for DBs in private registries [backport: release/v0.56] (aquasecurity#7691) Signed-off-by: knqyf263 <[email protected]> Co-authored-by: Teppei Fukuda <[email protected]> * fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (aquasecurity#7702) Signed-off-by: knqyf263 <[email protected]> Co-authored-by: Teppei Fukuda <[email protected]> * release: v0.56.2 [release/v0.56] (aquasecurity#7694) * Make liveness probe configurable (#3) --------- Signed-off-by: yusuke.koyoshi <[email protected]> Signed-off-by: knqyf263 <[email protected]> Signed-off-by: nikpivkin <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: Kevin Conner <[email protected]> Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Marcus Meissner <[email protected]> Co-authored-by: yusuke-koyoshi <[email protected]> Co-authored-by: Teppei Fukuda <[email protected]> Co-authored-by: Aruneko <[email protected]> Co-authored-by: Colm O hEigeartaigh <[email protected]> Co-authored-by: DmitriyLewen <[email protected]> Co-authored-by: afdesk <[email protected]> Co-authored-by: Nikita Pivkin <[email protected]> Co-authored-by: Alberto Donato <[email protected]> Co-authored-by: simar7 <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Itay Shakury <[email protected]> Co-authored-by: DmitriyLewen <[email protected]> Co-authored-by: aasish-r <[email protected]> Co-authored-by: Ori <[email protected]> Co-authored-by: Kevin Conner <[email protected]> Co-authored-by: Bob Callaway <[email protected]> Co-authored-by: vhash <[email protected]> Co-authored-by: psibre <[email protected]> Co-authored-by: Aqua Security automated builds <[email protected]> Co-authored-by: s-reddy1498 <[email protected]> Co-authored-by: Squiddim <[email protected]> Co-authored-by: Pierre Baumard <[email protected]> Co-authored-by: Lior Kaplan <[email protected]> Co-authored-by: amf <[email protected]> Co-authored-by: bloomadcariad <[email protected]> Co-authored-by: Sylvain Baubeau <[email protected]> Co-authored-by: Simar <[email protected]> Co-authored-by: Marcus Meissner <[email protected]> Co-authored-by: Samuel Gaist <[email protected]>

Add license handling to JUnit template

2def603

psibre requested a review from knqyf263 as a code owner August 27, 2024 16:28

knqyf263 requested a review from afdesk August 30, 2024 07:30

afdesk requested changes Aug 30, 2024

View reviewed changes

contrib/junit.tpl Outdated Show resolved Hide resolved

Move license handling after misconf handling in JUnit template

48cb569

psibre requested a review from afdesk August 31, 2024 17:16

afdesk approved these changes Sep 2, 2024

View reviewed changes

contrib/junit.tpl Show resolved Hide resolved

knqyf263 added this pull request to the merge queue Sep 3, 2024

Merged via the queue into aquasecurity:main with commit f80183c Sep 3, 2024
12 checks passed

aqua-bot mentioned this pull request Sep 3, 2024

release: v0.55.0 [main] #7271

Merged

psibre deleted the fix-add-license-handling-to-junit-template branch September 4, 2024 07:30

fhielpos pushed a commit to giantswarm/trivy-upstream that referenced this pull request Dec 20, 2024

fix(license): add license handling to JUnit template (aquasecurity#7409)

505cad0

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(license): add license handling to JUnit template #7409

fix(license): add license handling to JUnit template #7409

psibre commented Aug 27, 2024 •

edited

Loading

psibre commented Aug 29, 2024

psibre commented Aug 29, 2024

knqyf263 commented Aug 30, 2024

afdesk commented Aug 30, 2024

afdesk commented Aug 30, 2024

psibre commented Aug 30, 2024

afdesk commented Aug 30, 2024

fix(license): add license handling to JUnit template #7409

fix(license): add license handling to JUnit template #7409

Conversation

psibre commented Aug 27, 2024 • edited Loading

Description

Related issues

Checklist

psibre commented Aug 29, 2024

Preliminaries

Vulnerability scanner

Table format

JUnit XML format

License scanner

Table format

JUnit XML format (before)

JUnit XML format (after)

psibre commented Aug 29, 2024

knqyf263 commented Aug 30, 2024

afdesk commented Aug 30, 2024

afdesk commented Aug 30, 2024

psibre commented Aug 30, 2024

afdesk commented Aug 30, 2024

psibre commented Aug 27, 2024 •

edited

Loading