NodeJS package-lock.json SBOM libraries list inconsistent #5532
Comments
DmitriyLewen
added
kind/bug
|
Hello @OfirSandak |
|
Hi @DmitriyLewen |
|
I created image containing npm v8 and your FROM node:alpine3.15
COPY ./package-lock.json /app/package-lock.json
/app # npm ls --package-lock-only
[email protected] /app
`-- (empty)
I don't have |
|
Hey - Any news about this issue? |
|
Hello @sapirif |
|
I will give you an example - I used this package json - and generated lock file with this command: npm install --package-lock-only after running trivy twice with this command: trivy fs --format cyclonedx package-lock.json checking "components" part - got a diff in packages - Moreover we get some libraries that are not similar in those 2 files: In libs but not in lib2 In lib2 but not in lib Hope this will be enough details |
|
Thank you! I'm currently working on another task. When I have time, I’ll check the example and write to you. |
|
Hello everyone! Created aquasecurity/go-dep-parser#280 to fix this problem. |
|
Hi @DmitriyLewen, latest Trivy version released last week doesn't include this fix, is it possible to update Trivy to use go-dep-parser latest version? |
|
#5837 will be included in v0.49.0. |
|
The changes have been merged into |
Discussed in #5522
Originally posted by OfirSandak November 6, 2023
Description
I want to report an issue related to Trivy filesystem scan when generating CycloneDX SBOM from package-lock.json. The problem arises when running the scan multiple times, as it returns different libraries with each run.
Upon investigation, the root cause of this inconsistency appears to be the presence of two instances of a library in package-lock.json, one with "dev": true and another without. The issue lies within the go-dep-parser package. In the Node.js npm parser, the dependencies map in package-lock.json is unmarshaled into a slice. During this process, any duplicate libraries are removed. However, the first instance of a library is kept after deduplication. Since the map unmarshaling is not in order, the first instance of the library can be either with or without "dev": true.
In the Trivy local scan, the dev libraries are removed at the excludeDevDeps function in pkg/scanner/local/scan.go. Consequently, this leads to different results for the same package-lock.json file.
Desired Behavior
Runs should be consistent, ensuring that libraries with an instance of
"dev": falsealways supersede any instance with"dev": true.Actual Behavior
The inconsistency arises because each run produces different results, depending on which library instance is first unmarshaled from the package-lock.json file
Reproduction Steps
Running this command: trivy fs --scanners license --license-full --license-confidence-level 0.4 --format cyclonedx package-lock.json Example package-lock.json: { "name": "store", "version": "1.13.0", "lockfileVersion": 1, "requires": true, "dependencies": { "rs": { "version": "3.0.0", "resolved": "https://someothersite.com/repository/rs-npm-group/rs/-/rs-3.0.0.tgz", "integrity": "sha512-EUAyP5UHU5hxF8VPT0LKfW8gjYLshq1DQIcneOX/pL/m2Alo+OYDQAJlHq+yseMP50Os2nHXOSic6Ss3vSQeyf4A==", "dev": true, "requires": { "readable-stream": "^3.0.1" }, "dependencies": { "readable-stream": { "version": "3.6.0", "resolved": "https://someothersite.com/repository/ps-npm-group/readable-stream/-/readable-stream-3.6.0.tgz", "integrity": "sha512-BViHy7LKeVz4oNnkcLJ+lVSL6dvpiFeX6/d3oSH8zCW7UxP2oncdhk+vTGB143xuFjHS3deTgkKoXXymXqymiIdA==", "dev": true, "requires": { "inherits": "^2.0.3", "string_decoder": "^1.1.1", "util-deprecate": "^1.0.1" } }, "safe-buffer": { "version": "5.2.0", "resolved": "https://someothersite.com/repository/ps-npm-group/safe-buffer/-/safe-buffer-5.2.0.tgz", "integrity": "sha512-fZEwUGbVV7kouZs1jCdMfLdt95hdIv0ZeHg6L7qPeciMZhsZ+/gdesW4wgTARkrFWEpspjEATAzUGPG8N2jJiwbg==", "dev": true }, "string_decoder": { "version": "1.3.0", "resolved": "https://someothersite.com/repository/ps-npm-group/string_decoder/-/string_decoder-1.3.0.tgz", "integrity": "sha512-hkRX8U1WjJFd8LVDJ2yQ/wWgWxaopEsABU1XfkM8A+j0s+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==", "dev": true, "requires": { "safe-buffer": "~5.2.0" } } } }, "sorted-union-stream": { "version": "2.1.3", "bundled": true, "dev": true, "requires": { "from2": "^1.3.0", "stream-iterate": "^1.1.0" }, "dependencies": { "from2": { "version": "1.3.0", "bundled": true, "dev": true, "requires": { "inherits": "~2.0.1", "readable-stream": "~1.1.10" } }, "isarray": { "version": "0.0.1", "bundled": true, "dev": true }, "readable-stream": { "version": "1.1.14", "bundled": true, "dev": true, "requires": { "core-util-is": "~1.0.0", "inherits": "~2.0.1", "isarray": "0.0.1", "string_decoder": "~0.10.x" } }, "string_decoder": { "version": "0.10.31", "bundled": true, "dev": true } } }, "string_decoder": { "version": "0.10.31", "resolved": "https://somesite.com:4873/string_decoder/-/string_decoder-0.10.31.tgz", "integrity": "sha1-YuIDvEF2bGwoyfYfEfMB2rHFMS+pQ=" } } } Sometimes the SBOM results with no library: { "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.5", "serialNumber": "urn:uuid:acc20020-5aa2-4697-99e4-9e6f5ae38d39", "version": 1, "metadata": { "timestamp": "2023-11-06T10:22:06+00:00", "tools": [ { "vendor": "aquasecurity", "name": "trivy", "version": "0.44.1" } ], "component": { "bom-ref": "a8432caf-eb70-4d5c-8367-4ad4d511d9fb", "type": "application", "name": "package-lock.json", "properties": [ { "name": "aquasecurity:trivy:SchemaVersion", "value": "2" } ] } }, "components": [], "dependencies": [ { "ref": "a8432caf-eb70-4d5c-8367-4ad4d511d9fb", "dependsOn": [] } ], "vulnerabilities": [] } Sometime with SBOM results containing string_decoder library: { "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.5", "serialNumber": "urn:uuid:9584412b-e641-4d28-b8bd-a3210fa912b2", "version": 1, "metadata": { "timestamp": "2023-11-06T10:22:05+00:00", "tools": [ { "vendor": "aquasecurity", "name": "trivy", "version": "0.44.1" } ], "component": { "bom-ref": "6c4a5ce3-6c04-442d-8713-eeba498a987e", "type": "application", "name": "package-lock.json", "properties": [ { "name": "aquasecurity:trivy:SchemaVersion", "value": "2" } ] } }, "components": [ { "bom-ref": "16c041e0-974a-401a-83e5-38fcaa4dea9f", "type": "application", "name": "package-lock.json", "properties": [ { "name": "aquasecurity:trivy:Class", "value": "lang-pkgs" }, { "name": "aquasecurity:trivy:Type", "value": "npm" } ] }, { "bom-ref": "pkg:npm/[email protected]", "type": "library", "name": "string_decoder", "version": "0.10.31", "purl": "pkg:npm/[email protected]", "properties": [ { "name": "aquasecurity:trivy:PkgID", "value": "[email protected]" }, { "name": "aquasecurity:trivy:PkgType", "value": "npm" } ] } ], "dependencies": [ { "ref": "16c041e0-974a-401a-83e5-38fcaa4dea9f", "dependsOn": [ "pkg:npm/[email protected]" ] }, { "ref": "6c4a5ce3-6c04-442d-8713-eeba498a987e", "dependsOn": [ "16c041e0-974a-401a-83e5-38fcaa4dea9f" ] }, { "ref": "pkg:npm/[email protected]", "dependsOn": [] } ], "vulnerabilities": [] }Target
Filesystem
Scanner
None
Output Format
CycloneDX
Mode
Standalone
Debug Output
Operating System
macOS 13.6
Version
Checklist
trivy image --resetThe text was updated successfully, but these errors were encountered: