fix: report with os-packages is missing installed files

pkg/fanal/analyzer/analyzer.go

@@ -3,6 +3,7 @@ package analyzer
 import (
 	"context"
 	"errors"
+	"fmt"
 	"io/fs"
 	"os"
 	"regexp"
@@ -495,11 +496,31 @@ func (ag AnalyzerGroup) PostAnalyze(ctx context.Context, compositeFS *CompositeF
 		if err != nil {
 			return xerrors.Errorf("post analysis error: %w", err)
 		}
+		if len(res.Applications) > 0 && res.Applications[0].FilePath == "test" {
+			for _, a := range result.Applications {
+				appInstalledfiles := make([]string, 0)
+				fileBasePath := strings.TrimSuffix(a.FilePath, "package.json")
+				for _, f := range res.Applications[0].Libraries[0].InstalledFiles {
+					if strings.HasPrefix(f, fileBasePath) {
+						appInstalledfiles = append(appInstalledfiles, fmt.Sprintf("/%s", f))
+					}
+				}
+				appInstalledfiles = append(appInstalledfiles, fmt.Sprintf("/%s", a.FilePath))
+				updateInstalledFiles(&a, appInstalledfiles)
+			}
+			return nil
+		}
 		result.Merge(res)
 	}
 	return nil
 }
 
+func updateInstalledFiles(app *types.Application, installedFiles []string) {
+	for i, lib := range app.Libraries {
+		app.Libraries[i].InstalledFiles = append(lib.InstalledFiles, installedFiles...)
+	}
+}
+
 // PostAnalyzerFS returns a composite filesystem that contains multiple filesystems for each post-analyzer
 func (ag AnalyzerGroup) PostAnalyzerFS() (*CompositeFS, error) {
 	return NewCompositeFS(ag)

pkg/fanal/analyzer/language/nodejs/pkg/pkg.go

@@ -2,19 +2,26 @@ package pkg
 
 import (
 	"context"
+	//"fmt"
+	//	"fmt"
+	"io"
+	"io/fs"
 	"os"
 	"path/filepath"
+	"strings"
 
 	dio "github.com/aquasecurity/go-dep-parser/pkg/io"
 	"github.com/aquasecurity/go-dep-parser/pkg/nodejs/packagejson"
 	godeptypes "github.com/aquasecurity/go-dep-parser/pkg/types"
 	"github.com/aquasecurity/trivy/pkg/fanal/analyzer"
 	"github.com/aquasecurity/trivy/pkg/fanal/analyzer/language"
 	"github.com/aquasecurity/trivy/pkg/fanal/types"
+	"github.com/aquasecurity/trivy/pkg/utils/fsutils"
 )
 
 func init() {
 	analyzer.RegisterAnalyzer(&nodePkgLibraryAnalyzer{})
+	analyzer.RegisterPostAnalyzer(analyzer.TypeNodePkg, newNodePkgLibraryAnalyzer)
 }
 
 const (
@@ -24,6 +31,10 @@ const (
 
 type parser struct{}
 
+func newNodePkgLibraryAnalyzer(_ analyzer.AnalyzerOptions) (analyzer.PostAnalyzer, error) {
+	return &nodePkgLibraryAnalyzer{}, nil
+}
+
 func (*parser) Parse(r dio.ReadSeekerAt) ([]godeptypes.Library, []godeptypes.Dependency, error) {
 	p := packagejson.NewParser()
 	pkg, err := p.Parse(r)
@@ -44,11 +55,14 @@ type nodePkgLibraryAnalyzer struct{}
 
 // Analyze analyzes package.json for node packages
 func (a nodePkgLibraryAnalyzer) Analyze(_ context.Context, input analyzer.AnalysisInput) (*analyzer.AnalysisResult, error) {
-	return language.AnalyzePackage(types.NodePkg, input.FilePath, input.Content, &parser{}, input.Options.FileChecksum)
+	if requiredFile == filepath.Base(input.FilePath) {
+		return language.AnalyzePackage(types.NodePkg, input.FilePath, input.Content, &parser{}, input.Options.FileChecksum)
+	}
+	return &analyzer.AnalysisResult{}, nil
 }
 
 func (a nodePkgLibraryAnalyzer) Required(filePath string, _ os.FileInfo) bool {
-	return requiredFile == filepath.Base(filePath)
+	return requiredFile == filepath.Base(filePath) || strings.Contains(filePath, "node_modules")
 }
 
 func (a nodePkgLibraryAnalyzer) Type() analyzer.Type {
@@ -58,3 +72,31 @@ func (a nodePkgLibraryAnalyzer) Type() analyzer.Type {
 func (a nodePkgLibraryAnalyzer) Version() int {
 	return version
 }
+
+func (a nodePkgLibraryAnalyzer) PostAnalyze(_ context.Context, input analyzer.PostAnalysisInput) (*analyzer.AnalysisResult, error) {
+	// Parse package-lock.json
+	required := func(path string, _ fs.DirEntry) bool {
+		return strings.Contains(path, "node_modules")
+	}
+	files := make([]string, 0)
+	fsutils.WalkDir(input.FS, ".", required, func(filePath string, d fs.DirEntry, r io.Reader) error {
+		// Find all licenses from package.json files under node_modules dirs
+		files = append(files, filePath)
+		return nil
+	})
+	if len(files) == 0 {
+		return &analyzer.AnalysisResult{}, nil
+	}
+	return &analyzer.AnalysisResult{
+		Applications: []types.Application{
+			{
+				FilePath: "test",
+				Libraries: []types.Package{
+					{
+						InstalledFiles: files,
+					},
+				},
+			},
+		},
+	}, nil
+}