Skip to content

bug(secret): Trivy incurrect detects line numbers for multi-line secrets #9086

@DmitriyLewen

Description

@DmitriyLewen

Description

Secrets can be milti-lines (e.g. AsymmetricPrivateKey).
But Trivy detects them as single-line secrets.
That is why Trivy shows incorrect line numbers for these secrets.

example:

➜ cat 1.txt                                                  
my_key_private: |
  -----BEGIN RSA PRIVATE KEY-----
  AAABbbCCCCCCCQEAoLVDC0vA+b6JV1JXOy3ir10mECNmsfQDArXxpe5K1tUu9dPy
  3U4hKVuGNCac7lGOgdN89UQh8ddwlsC2uBaE5KjV4CFOYR9MDrE=
  -----END RSA PRIVATE KEY-----
# 6 line                                                                                                                                                                                           
➜ trivy -q fs --scanners secret ./1.txt --table-mode detailed

/1.txt (secrets)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

HIGH: AsymmetricPrivateKey (private-key)
════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Asymmetric Private Key
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 /1.txt:2
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   my_key_private: |
   2 [ ----BEGIN RSA PRIVATE KEY-----*****************************************************************************************************************************-----END RSA PRIVATE
   3   # 6 line
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Discussed in #9085

Metadata

Metadata

Assignees

Labels

kind/bugCategorizes issue or PR as related to a bug.scan/secretIssues relating to secret scanning

Type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions