Invalid purls due of a final slash

[javierfreire]

Description

Trivy generates invalid purls due to a final slash. Example:

pkg:golang/./private_repos/cnrm.googlesource.com/cnrm/@%28devel%29

Desired Behavior

All the purls are valid

Actual Behavior

The SPDX generated includes invalid purls like

    {
      "name": "./private_repos/cnrm.googlesource.com/cnrm/",
      "SPDXID": "SPDXRef-Package-8af38db75eabab2a",
      "versionInfo": "(devel)",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "licenseConcluded": "NONE",
      "licenseDeclared": "NONE",
      "copyrightText": "",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:golang/./private_repos/cnrm.googlesource.com/cnrm/@%28devel%29"
        }
      ],
      "attributionTexts": [
        "LayerDigest: sha256:d91b0bf3062475915a26bfbed055cd9544802b07df8fd11b29f47e63932e291d",
        "LayerDiffID: sha256:aee734b82faf27cee18e8619a5e5bb100ed544eaeaa2d6eebd574b180cc661a7"
      ],
      "primaryPackagePurpose": "LIBRARY"
    },

Reproduction Steps

$ trivy image bitnami/google-cloud-sdk:0.444.0 --format spdx-json

Target

Container Image

Scanner

None

Output Format

SPDX

Mode

Standalone

Debug Output

$ trivy image bitnami/google-cloud-sdk:0.444.0 --format spdx-json --debug

2023-09-01T10:29:31.871+0200    DEBUG   ["cyclonedx" "spdx" "spdx-json" "github"] automatically enables '--list-all-pkgs'.
2023-09-01T10:29:31.871+0200    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-09-01T10:29:31.872+0200    DEBUG   Ignore statuses {"statuses": null}
2023-09-01T10:29:31.872+0200    INFO    "--format spdx" and "--format spdx-json" disable security scanning
2023-09-01T10:29:31.879+0200    DEBUG   cache dir:  /home/fjavier/.cache/trivy
2023-09-01T10:29:33.665+0200    DEBUG   Image ID: sha256:39d35ef16bb0c3f138134016c25ff29a04eab94c7991f30ea0b2e9c7f4912d90
2023-09-01T10:29:33.665+0200    DEBUG   Diff IDs: [sha256:aee734b82faf27cee18e8619a5e5bb100ed544eaeaa2d6eebd574b180cc661a7]
2023-09-01T10:29:33.665+0200    DEBUG   Base Layers: []

Operating System

Ubuntu 23.04

Version

Version: 0.45.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-09-01 06:12:26.321581659 +0000 UTC
  NextUpdate: 2023-09-01 12:12:26.321581259 +0000 UTC
  DownloadedAt: 2023-09-01 06:46:30.004219829 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2023-08-21 00:57:30.973349538 +0000 UTC
  NextUpdate: 2023-08-24 00:57:30.973348738 +0000 UTC
  DownloadedAt: 2023-08-21 12:17:26.687255254 +0000 UTC

Checklist

• Run trivy image --reset
• Read the troubleshooting

[nikpivkin]

@javierfreire Do you mean the slash before the version at the end of the name?

[knqyf263]

We use the official library. Shouldn't they take care of that?
https://github.com/package-url/packageurl-go

[javierfreire]

Perhaps, but Trivy should check it in any case.
You can verify that the purl is invalid using the official library:

package main

import (
	"fmt"

	"github.com/package-url/packageurl-go"
)

func main() {
	instance, err := packageurl.FromString("pkg:golang/./private_repos/cnrm.googlesource.com/cnrm/@%28devel%29")
	if err != nil {
		panic(err)
	}
	fmt.Printf("%#v", instance)
}

But, the problem is that it allows the creation of a purl with an empty name:

import (
	"fmt"

	"github.com/package-url/packageurl-go"
)

func main() {
	instance := packageurl.NewPackageURL("golang", "./private_repos/cnrm.googlesource.com/cnrm", "", "(devel)", nil, "")
	fmt.Printf("%s", instance.ToString())
}

The empty name is caused by the function parsePkgName. When the argument ends with a slash (f.e. a local path: ./private_repos/cnrm.googlesource.com/cnrm/), this function returns an empty string as name.

[knqyf263]

The library exports invalid PURL strings.
https://go.dev/play/p/0YVj6PqkXu2

I'm not sure Trivy should check it. For example, when Trivy generates JSON, Trivy doesn't check if the content is valid JSON or not. The library should generate valid content.

[javierfreire]

I agree, but the library is raising a bad purl because Trivy invokes it with an empty name. When the library throws an error due to the empty name, Trivy will have to fix it.

Let me explain it. Trivy splits a path in namespace and name and then generates the PURL, but when the path ends with a slash it calculates an empty name.

So, I think by making a little change in the function parsePkgName the error can be avoided.

[knqyf263]

OK, created #5188

[nikpivkin]

@knqyf263 The SPDX validator returned an error when checking the generated SPDX: Analysis exception processing SPDX file: Duplicate SPDX ID: SPDXRef-File-6b055903added21a. I think we should remove duplicate files.

[knqyf263]

Sounds like you're right. Can we catch such errors with this PR?
#5124

[nikpivkin]

It is not possible to check the uniqueness of objects by property using a json schema. I found a document validation function in the spdx package, but it doesn't check this case. But I think it can also be used for document validation, WDYT?

[knqyf263]

Yes, we should use it.