Replies: 2 comments 2 replies
-
|
Hi @dstubked ! |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for replying. Is there anything we can do about this? Having accurate line numbers does help to enable us find the issue faster. |
Beta Was this translation helpful? Give feedback.
-
|
on the other hand, I believe the files are already in yaml format? Am I missing something here? |
Beta Was this translation helpful? Give feedback.
-
|
@dstubked as we discussed offline - today we use helm package to render templates in yaml, so we lose the ability to match the positions of the resulting file with the original file. When scanning helm configuration, reports already contains content of rendered templates. This is because a template is without the extrapolated (rendered) values. A template, by itself, has no "misconfigurations" unless it is rendered based on some logic. While I think I understand your comment about line numbers not matching up, we are limited based on the above comments. IMHO the line numbers we show vs what the unrendered chart has are pretty close enough for the user to realize the misconfiguration. We could investigate to see if we can keep the positional information from source files (charts), when misconfigurations in renders are found. This would add logical complexity to Trivy, something at this point I'm not sure if, is worth the effort. |
Beta Was this translation helpful? Give feedback.
-
Description
I am getting some weird results scanning helm charts.
If you look at the scan results below, it shows the problem exist from line 11 to 17.
However, in the actual source code, the number exist in line 17 to 23.
Desired Behavior
We should print the right line numbers according to the contents of the file.
Actual Behavior
I am getting some weird results scanning helm charts.
If you look at the scan results below, it shows the problem exist from line 11 to 17.
However, in the actual source code, the number exist in line 17 to 23.
Reproduction Steps
You can replicate the problem by pulling from https://github.com/hashicorp/vault-helm.git Use the following trivy command: trivy fs --scanners misconfig --severity CRITICAL . You should be able to replicate it.Target
Filesystem
Scanner
Misconfiguration
Output Format
Table
Mode
Standalone
Debug Output
Operating System
Mac Sequoia
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions