fix(cyclonedx): fix work when there are same pkgs from different dirs

[DmitriyLewen]

Description

Fixes for cases when same packages are found in different directories:

➜ tree dir
dir
├── dir1
│   └── jackson-databind-2.13.4.jar
└── dir2
    └── jackson-databind-2.13.4.jar

1. return all found packages:
   before:

  "components": [
    {
      "bom-ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?file_path=dir1%2Fjackson-databind-2.13.4.jar",
      "type": "library",
      "group": "com.fasterxml.jackson.core",
      "name": "jackson-databind",
      "version": "2.13.4",
      "purl": "pkg:maven/com.fasterxml.jackson.core/[email protected]",
      "properties": [
        {
          "name": "aquasecurity:trivy:FilePath",
          "value": "dir1/jackson-databind-2.13.4.jar"
        },
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "jar"
        }
      ]
    }
  ],

after:

  "components": [
    {
      "bom-ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?file_path=dir1%2Fjackson-databind-2.13.4.jar",
      "type": "library",
      "group": "com.fasterxml.jackson.core",
      "name": "jackson-databind",
      "version": "2.13.4",
      "purl": "pkg:maven/com.fasterxml.jackson.core/[email protected]",
      "properties": [
        {
          "name": "aquasecurity:trivy:FilePath",
          "value": "dir1/jackson-databind-2.13.4.jar"
        },
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "jar"
        }
      ]
    },
    {
      "bom-ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?file_path=dir2%2Fjackson-databind-2.13.4.jar",
      "type": "library",
      "group": "com.fasterxml.jackson.core",
      "name": "jackson-databind",
      "version": "2.13.4",
      "purl": "pkg:maven/com.fasterxml.jackson.core/[email protected]",
      "properties": [
        {
          "name": "aquasecurity:trivy:FilePath",
          "value": "dir2/jackson-databind-2.13.4.jar"
        },
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "jar"
        }
      ]
    }
  ],

2. show correct ref's for vulnerabilities.affects.
   before(dir2 and dir2):

      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?file_path=dir2%2Fjackson-databind-2.13.4.jar",
          "versions": [
            {
              "version": "2.13.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?file_path=dir2%2Fjackson-databind-2.13.4.jar",
          "versions": [
            {
              "version": "2.13.4",
              "status": "affected"
            }
          ]
        }
      ]

after(dir1 + dir2):

      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?file_path=dir1%2Fjackson-databind-2.13.4.jar",
          "versions": [
            {
              "version": "2.13.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?file_path=dir2%2Fjackson-databind-2.13.4.jar",
          "versions": [
            {
              "version": "2.13.4",
              "status": "affected"
            }
          ]
        }
      ]

Related issues

• Close bug(cyclonedx): Trivy image scan reports and counts the same CVE for the same package multiple times #5796

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

I only separated same packages from different directories.
But looks like we can merge these packages into 1 component with multiple aquasecurity:trivy:FilePath properties.
e.g.:

"components": [
    {
      "bom-ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?file_path=dir1%2Fjackson-databind-2.13.4.jar",
      "type": "library",
      "group": "com.fasterxml.jackson.core",
      "name": "jackson-databind",
      "version": "2.13.4",
      "purl": "pkg:maven/com.fasterxml.jackson.core/[email protected]",
      "properties": [
        {
          "name": "aquasecurity:trivy:FilePath",
          "value": "dir1/jackson-databind-2.13.4.jar"
        },
        {
          "name": "aquasecurity:trivy:FilePath",
          "value": "dir2/jackson-databind-2.13.4.jar"
        },
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "jar"
        }
      ]
    }
  ],

CycloneDX supports duplicate keys for properties: Unlike key-value stores, properties support duplicate names, each potentially having different values
https://cyclonedx.org/docs/1.5/json/#components_items_properties

@knqyf263 wdyt?

[DmitriyLewen]

This only applies to Packages (jar, package.json, etc.) because pkg.FilePath is only saved for Packages:

trivy/pkg/fanal/types/artifact.go

Lines 91 to 92 in abf227e

	// Each package metadata have the file path, while the package from lock files does not have.
	FilePath string `json:",omitempty"`

[DmitriyLewen]

pkgs map is used only for dependency iteration.
But Packages don't contain dependencies (DependsOn fields).

So it doesn't break logic.

[DmitriyLewen]

I thought about saving slice of ftypes.Package's or slice of FilePath's, but i understood that we still can't get correct package, because DependsOn doesn't currently contain info about filepath.

Looks like this update is enough for now.

If we will add Package with DependsOn - we will need to update DependsOn struct (and logic for this) and we can update logic for CycloneDX.

[DmitriyLewen]

same:

trivy/pkg/detector/library/detect.go

Line 35 in abf227e

vulns[i].PkgPath = lib.FilePath

[github-actions]

This PR is stale because it has been labeled with inactivity.

[github-actions]

This PR is stale because it has been labeled with inactivity.

[topiga]

This should be reviewed...

[DmitriyLewen]

#6240 fixed this problem.