fix(report): don't panic when report contains vulns, but doesn't contain packages for `table` format #8549

DmitriyLewen · 2025-03-14T05:31:00Z

Description

When using Trivy as a library, there may be cases where the Result with vulnerabilities does not contain any packages.
Trivy panics in these cases.
To avoid panic and return at least some information, for such cases we use Vulnerabilities instead of Packages to separate aggregated packages.

Related discussions

Trivy is crashing with "panic: runtime error: invalid memory address or nil pointer dereference" when scanning for HIGH/CRIT vulnerabilities #8537

Related issues

Close bug(report): Trivy panics when converting json report without Packages to table report with summary table #8622

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

- don't use pointer for `resultMap` - use packages from vulnerabilities if Packages is empty - add warning about this case

- add test for case when result contains vulns, but doesn't contain Packages

simar7

lgtm, @DmitriyLewen should we include it in this release?

DmitriyLewen · 2025-03-28T03:36:18Z

for convert mode - it's not big deal because we ask users to always use --list-all-pkgs for the base json file.
for client/server mode I still couldn't reproduce the bug

so we haven't decided yet what the right solution for this problem will be (see #8537 (reply in thread))

so I think we can leave it out of the release until we reproduce the bug

github-actions · 2025-06-07T00:08:25Z

This PR is stale because it has been labeled with inactivity.

knqyf263

Sorry I've been missing this PR.

…nic-summary-table

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mirror.gcr.io/aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | minor | `0.63.0` -> `0.64.1` | --- ### Release Notes <details> <summary>aquasecurity/trivy (mirror.gcr.io/aquasec/trivy)</summary> ### [`v0.64.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.64.1) [Compare Source](aquasecurity/trivy@v0.64.0...v0.64.1) #### Changelog - [`86ee3c1`](aquasecurity/trivy@86ee3c1) release: v0.64.1 \[release/v0.64] ([#9122](aquasecurity/trivy#9122)) - [`4e12722`](aquasecurity/trivy@4e12722) fix(misconf): skip rewriting expr if attr is nil \[backport: release/v0.64] ([#9127](aquasecurity/trivy#9127)) - [`9a7d384`](aquasecurity/trivy@9a7d384) fix(cli): Add more non-sensitive flags to telemetry \[backport: release/v0.64] ([#9124](aquasecurity/trivy#9124)) - [`53adfba`](aquasecurity/trivy@53adfba) fix(rootio): check full version to detect `root.io` packages \[backport: release/v0.64] ([#9120](aquasecurity/trivy#9120)) - [`8cf1bf9`](aquasecurity/trivy@8cf1bf9) fix(alma): parse epochs from rpmqa file \[backport: release/v0.64] ([#9119](aquasecurity/trivy#9119)) ### [`v0.64.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0640-2025-06-30) [Compare Source](aquasecurity/trivy@v0.63.0...v0.64.0) ##### Features - **cli:** add version constraints to annoucements ([#9023](aquasecurity/trivy#9023)) ([19efa9f](aquasecurity/trivy@19efa9f)) - **java:** dereference all maven settings.xml env placeholders ([#9024](aquasecurity/trivy#9024)) ([5aade69](aquasecurity/trivy@5aade69)) - **misconf:** add OpenTofu file extension support ([#8747](aquasecurity/trivy#8747)) ([57801d0](aquasecurity/trivy@57801d0)) - **misconf:** normalize CreatedBy for buildah and legacy docker builder ([#8953](aquasecurity/trivy#8953)) ([65e155f](aquasecurity/trivy@65e155f)) - **redhat:** Add EOL date for RHEL 10. ([#8910](aquasecurity/trivy#8910)) ([48258a7](aquasecurity/trivy@48258a7)) - reject unsupported artifact types in remote image retrieval ([#9052](aquasecurity/trivy#9052)) ([1e1e1b5](aquasecurity/trivy@1e1e1b5)) - **sbom:** add manufacturer field to CycloneDX tools metadata ([#9019](aquasecurity/trivy#9019)) ([41d0f94](aquasecurity/trivy@41d0f94)) - **terraform:** add partial evaluation for policy templates ([#8967](aquasecurity/trivy#8967)) ([a9f7dcd](aquasecurity/trivy@a9f7dcd)) - **ubuntu:** add end of life date for Ubuntu 25.04 ([#9077](aquasecurity/trivy#9077)) ([367564a](aquasecurity/trivy@367564a)) - **ubuntu:** add eol date for 20.04-ESM ([#8981](aquasecurity/trivy#8981)) ([87118a0](aquasecurity/trivy@87118a0)) - **vuln:** add Root.io support for container image scanning ([#9073](aquasecurity/trivy#9073)) ([3a0ec0f](aquasecurity/trivy@3a0ec0f)) ##### Bug Fixes - Add missing version check flags ([#8951](aquasecurity/trivy#8951)) ([ef5f8de](aquasecurity/trivy@ef5f8de)) - **cli:** add some values to the telemetry call ([#9056](aquasecurity/trivy#9056)) ([fd2bc91](aquasecurity/trivy@fd2bc91)) - Correctly check for semver versions for trivy version check ([#8948](aquasecurity/trivy#8948)) ([b813527](aquasecurity/trivy@b813527)) - don't show corrupted trivy-db warning for first run ([#8991](aquasecurity/trivy#8991)) ([4ed78e3](aquasecurity/trivy@4ed78e3)) - **misconf:** .Config.User always takes precedence over USER in .History ([#9050](aquasecurity/trivy#9050)) ([371b8cc](aquasecurity/trivy@371b8cc)) - **misconf:** correct Azure value-to-time conversion in AsTimeValue ([#9015](aquasecurity/trivy#9015)) ([40d017b](aquasecurity/trivy@40d017b)) - **misconf:** move disabled checks filtering after analyzer scan ([#9002](aquasecurity/trivy#9002)) ([a58c36d](aquasecurity/trivy@a58c36d)) - **misconf:** reduce log noise on incompatible check ([#9029](aquasecurity/trivy#9029)) ([99c5151](aquasecurity/trivy@99c5151)) - **nodejs:** correctly parse `packages` array of `bun.lock` file ([#8998](aquasecurity/trivy#8998)) ([875ec3a](aquasecurity/trivy@875ec3a)) - **report:** don't panic when report contains vulns, but doesn't contain packages for `table` format ([#8549](aquasecurity/trivy#8549)) ([87fda76](aquasecurity/trivy@87fda76)) - **sbom:** remove unnecessary OS detection check in SBOM decoding ([#9034](aquasecurity/trivy#9034)) ([198789a](aquasecurity/trivy@198789a)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/812 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

DmitriyLewen added 3 commits March 14, 2025 11:04

fix(table): don't panic for splitAggregatedVulns

a80410c

- don't use pointer for `resultMap` - use packages from vulnerabilities if Packages is empty - add warning about this case

test(unit): add unit test

17b9580

- add test for case when result contains vulns, but doesn't contain Packages

chore(logs): add target for warning

34a2588

DmitriyLewen self-assigned this Mar 14, 2025

DmitriyLewen requested a review from knqyf263 as a code owner March 14, 2025 05:31

DmitriyLewen changed the title ~~fix(table): don't panic when report contains vulns, but doesn't contain packages~~ fix(report): don't panic when report contains vulns, but doesn't contain packages for table format Mar 14, 2025

simar7 approved these changes Mar 27, 2025

View reviewed changes

DmitriyLewen added 2 commits April 7, 2025 17:46

refactor

6b9e3ef

fix: mistake

e1b55b9

github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and will be auto-closed. label Jun 7, 2025

DmitriyLewen removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and will be auto-closed. label Jun 9, 2025

knqyf263 approved these changes Jun 9, 2025

View reviewed changes

Merge branch 'main' of github.com:DmitriyLewen/trivy into fix/dont-pa…

0273caf

…nic-summary-table

DmitriyLewen added this pull request to the merge queue Jun 10, 2025

Merged via the queue into aquasecurity:main with commit 87fda76 Jun 10, 2025
12 checks passed

DmitriyLewen deleted the fix/dont-panic-summary-table branch June 10, 2025 05:40

aqua-bot mentioned this pull request Jun 10, 2025

release: v0.64.0 [main] #8955

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(report): don't panic when report contains vulns, but doesn't contain packages for `table` format #8549

fix(report): don't panic when report contains vulns, but doesn't contain packages for `table` format #8549

Uh oh!

DmitriyLewen commented Mar 14, 2025 •

edited

Loading

Uh oh!

simar7 left a comment

Uh oh!

DmitriyLewen commented Mar 28, 2025

Uh oh!

github-actions bot commented Jun 7, 2025

Uh oh!

knqyf263 left a comment

Uh oh!

Uh oh!

Uh oh!

fix(report): don't panic when report contains vulns, but doesn't contain packages for table format #8549

fix(report): don't panic when report contains vulns, but doesn't contain packages for table format #8549

Uh oh!

Conversation

DmitriyLewen commented Mar 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related discussions

Related issues

Checklist

Uh oh!

simar7 left a comment

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen commented Mar 28, 2025

Uh oh!

github-actions bot commented Jun 7, 2025

Uh oh!

knqyf263 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

fix(report): don't panic when report contains vulns, but doesn't contain packages for `table` format #8549

fix(report): don't panic when report contains vulns, but doesn't contain packages for `table` format #8549

DmitriyLewen commented Mar 14, 2025 •

edited

Loading