Trivy doesn't work with nested POM files and properties

[okainov]

Description

We have a nested structure with POM files where we define the versions used in parent-level POM in properties:

<properties>
  <ebr.com.google.guava.version>32.0.1</ebr.com.google.guava.version>

And then use it somewhere in children POM file:

  <version>${ebr.com.google.guava.version}-SNAPSHOT</version>

.....

    <dependency>
      <groupId>com.google.guava</groupId>
      <artifactId>guava</artifactId>
      <version>${ebr.com.google.guava.version}-jre</version>
    </dependency>

However it seems Trivy is not able to parse such structure correctly and it reports like no dependencies found.

Desired Behavior

Trivy detects the used library and versions correctly

Actual Behavior

Trivy reports 0 dependencies

Reproduction Steps

1. See description with examples of POMs
2.
3.
...

Target

Filesystem

Scanner

Vulnerability

Output Format

None

Mode

Standalone

Debug Output

...

Operating System

Linux

Version

latest

Checklist

• Run trivy image --reset
• Read the troubleshooting

[DmitriyLewen]

Hello @okainov
Thanks for your report!

We need more information. e.g.:

parent-level POM in properties:
Is it the parent from parent tag or the scanned pom.xml file?

children POM file:
Is it the dependency from dependencies tag or the scanned pom.xml file?

Can you create test pom.xml files and send to me?

Regards, Dmitriy

[okainov]

@DmitriyLewen thanks for looking into it! We've got the test reproducer, please see attached and let me know whether it helps!
pom_test.zip

[DmitriyLewen]

Hello @okainov
Thanks for you files.

I checked your files and found no problems:

➜ ls -hl
total 80
drwxr-xr-x@ 4 work  staff   128B Oct  6 16:57 child_a
drwxr-xr-x@ 4 work  staff   128B Oct  6 16:57 child_b
drwxr-xr-x@ 4 work  staff   128B Oct  6 16:57 child_c
-rw-r--r--@ 1 work  staff   2.3K Oct  6 16:54 pom.xml
-rw-r--r--@ 1 work  staff   315B Oct  6 17:00 readme.txt
-rw-r--r--@ 1 work  staff    32K Oct 11 10:15 result.json

➜ mvn dependency:tree | grep com.google.guava:guava
[INFO] +- com.google.guava:guava:jar:31.1-jre:compile
[INFO] |  \- com.google.guava:guava:jar:31.1-android:compile

➜ trivy -d fs -f json --list-all-pkgs ./pom.xml | jq '.Results[].Packages[] | select(.Name == "com.google.guava:guava")'
...
{
  "ID": "com.google.guava:guava:31.1-android",
  "Name": "com.google.guava:guava",
  "Version": "31.1-android",
  "Licenses": [
    "Apache License, Version 2.0"
  ],
  "Indirect": true,
  "DependsOn": [
    "com.google.code.findbugs:jsr305:3.0.2",
    "com.google.errorprone:error_prone_annotations:2.18.0",
    "com.google.guava:failureaccess:1.0.1",
    "com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava",
    "com.google.j2objc:j2objc-annotations:1.3",
    "org.checkerframework:checker-qual:3.12.0"
  ],
  "Layer": {}
}
{
  "ID": "com.google.guava:guava:31.1-jre",
  "Name": "com.google.guava:guava",
  "Version": "31.1-jre",
  "Licenses": [
    "Apache License, Version 2.0"
  ],
  "DependsOn": [
    "com.google.code.findbugs:jsr305:3.0.2",
    "com.google.errorprone:error_prone_annotations:2.11.0",
    "com.google.guava:failureaccess:1.0.1",
    "com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava",
    "com.google.j2objc:j2objc-annotations:1.3",
    "org.checkerframework:checker-qual:3.12.0"
  ],
  "Layer": {}
}

---

You use modules in your project.
Trivy scans pom.xml module files as separate files. Perhaps you got the wrong version from a separate module file?