bug(sarif): we need to handle schema for URI's for misconfig

[DmitriyLewen]

Description

We already clear URI with git::https:/ schema:

trivy/pkg/report/sarif.go

Line 350 in 015bb88

return strings.ReplaceAll(strings.ReplaceAll(s, "\\", "/"), "git::https:/", "")

We need to add logic for [email protected] schema.

Discussed in #7893

[nikpivkin]

I think we also need to properly handle other types of sources that we support

[nikpivkin]

I also noticed that the URI after cleaning may be valid but not correct. For example ‘git::https://example.com/vpc.git?ref=v1.2.0’ will become example.com/vpc?ref=v1.2.0, but nothing will be found at that link.

[DmitriyLewen]

I think we also need to properly handle other types of sources that we support

Do you have a list of possible types for misconfigs?

For example ‘git::https://example.com/vpc.git?ref=v1.2.0’ will become example.com/vpc?ref=v1.2.0, but nothing will be found at that link.

Hm... This is weird. hen what link should we show here?

[nikpivkin]

Do you have a list of possible types for misconfigs?

https://developer.hashicorp.com/terraform/language/modules/sources#module-sources

Hm... This is weird. hen what link should we show here?

Here's an example for an existing module:
[email protected]:terraform-aws-modules/terraform-aws-s3-bucket.git?ref=v4.2.0/main.tf -> github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/v4.2.0/main.tf

But I think it's worth studying the specification better.

upd: GitHub only works with local URIs.

[DmitriyLewen]

https://developer.hashicorp.com/terraform/language/modules/sources#module-sources

I will take a look

upd: GitHub only works with local URIs.

So we can skip other URIs (e.g. github, bitbacket, etc.), right?

[DmitriyLewen]

@nikpivkin I updated #7898 for GitHub links and other types.