html.tpl format template throws error parsing template: template unexpected "\\" in operand

[lmpeiris]

Description

When trying to use trivy to generate html report using html.tpl, below error is thrown.

trivy image --input container.tar --format template --template "@html.tpl" -o report.html

2023-11-09T09:18:28.952+0530 INFO Vulnerability scanning is enabled
2023-11-09T09:18:28.952+0530 INFO Secret scanning is enabled
2023-11-09T09:18:28.952+0530 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-11-09T09:18:28.952+0530 INFO Please see also https://aquasecurity.github.io/trivy/v0.47/docs/scanner/secret/#recommendation for faster secret detection
2023-11-09T09:18:29.122+0530 INFO Detected OS: debian
2023-11-09T09:18:29.122+0530 INFO Detecting Debian vulnerabilities...
2023-11-09T09:18:29.151+0530 INFO Number of language-specific files: 0
2023-11-09T09:18:29.162+0530 FATAL report error: unable to write results: failed to initialize template writer: error parsing template: template: output template:1: unexpected "\" in operand

Desired Behavior

generate report in html format

Actual Behavior

Below error is thrown

2023-11-09T09:18:29.162+0530 FATAL report error: unable to write results: failed to initialize template writer: error parsing template: template: output template:1: unexpected "\" in operand

Reproduction Steps

1. Install trivy using ubuntu apt install method (0.47.0)
2. create container.tar from a local podman container
3. download html.tpl from same release tag (wget https://github.com/aquasecurity/trivy/blob/v0.47.0/contrib/html.tpl)
4. run 'trivy image --input container.tar --format template --template "@html.tpl" -o report.html'
...

Target

Container Image

Scanner

Vulnerability

Output Format

Template

Mode

Standalone

Debug Output

trivy image --input container.tar --format template --template "@html.tpl" -o report.html --debug
2023-11-09T09:30:32.342+0530    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-11-09T09:30:32.344+0530    DEBUG   Ignore statuses {"statuses": null}
2023-11-09T09:30:32.348+0530    DEBUG   cache dir:  /home/lmpeiris/.cache/trivy
2023-11-09T09:30:32.348+0530    DEBUG   DB update was skipped because the local DB is the latest
2023-11-09T09:30:32.348+0530    DEBUG   DB Schema: 2, UpdatedAt: 2023-11-09 00:17:40.494427456 +0000 UTC, NextUpdate: 2023-11-09 06:17:40.494427156 +0000 UTC, DownloadedAt: 2023-11-09 03:37:45.067463491 +0000 UTC
2023-11-09T09:30:32.348+0530    INFO    Vulnerability scanning is enabled
2023-11-09T09:30:32.348+0530    DEBUG   Vulnerability type:  [os library]
2023-11-09T09:30:32.348+0530    INFO    Secret scanning is enabled
2023-11-09T09:30:32.348+0530    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-11-09T09:30:32.349+0530    INFO    Please see also https://aquasecurity.github.io/trivy/v0.47/docs/scanner/secret/#recommendation for faster secret detection
2023-11-09T09:30:32.511+0530    DEBUG   No secret config detected: trivy-secret.yaml
2023-11-09T09:30:32.512+0530    DEBUG   The nuget packages directory couldn't be found. License search disabled
2023-11-09T09:30:32.512+0530    DEBUG   No secret config detected: trivy-secret.yaml
2023-11-09T09:30:32.513+0530    DEBUG   Image ID: sha256:eea7b3dcba7ee47c0d16a60cc85d2b977d166be3960541991f3e6294d795ed24
2023-11-09T09:30:32.513+0530    DEBUG   Diff IDs: [sha256:511780f88f80081112aea1bfdca6c800e1983e401b338e20b2c6e97f384e4299 sha256:4713cb24eeff341d0c36343149beba247572a5ff65c2be5b5d9baafb345c7393 sha256:d0a62f56ef413f60049bc87e43e60032b2a2ab8d931e15b86ee0286c85ae91a2 sha256:8a7e12012e6f60450e6d2d777b2a2c2256d34a0ccd84d605f72cc5329a87c8b8 sha256:e161c3f476b5199ab13856c7e190ed12a6562b7be059c7026ae9f594e1abbcaf sha256:6fb960878295b567d25900b590157b976d080340caeaa8bf8c46d38c01b4537d sha256:563c64030925e9016a2329d3a2b7d47b0c90931baf5d2d0aa926c4c8d94ab894]
2023-11-09T09:30:32.513+0530    DEBUG   Base Layers: [sha256:511780f88f80081112aea1bfdca6c800e1983e401b338e20b2c6e97f384e4299]
2023-11-09T09:30:32.529+0530    INFO    Detected OS: debian
2023-11-09T09:30:32.529+0530    INFO    Detecting Debian vulnerabilities...
2023-11-09T09:30:32.529+0530    DEBUG   debian: os version: 12
2023-11-09T09:30:32.529+0530    DEBUG   debian: the number of packages: 149
2023-11-09T09:30:32.576+0530    INFO    Number of language-specific files: 0
2023-11-09T09:30:32.596+0530    FATAL   report error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:454
  - unable to write results:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).Report
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:284
  - failed to initialize template writer:
    github.com/aquasecurity/trivy/pkg/report.Write
        /home/runner/work/trivy/trivy/pkg/report/writer.go:76
  - error parsing template:
    github.com/aquasecurity/trivy/pkg/report.NewTemplateWriter
        /home/runner/work/trivy/trivy/pkg/report/template.go:65
  - template: output template:1: unexpected "\\" in operand

Operating System

ubuntu 22.04.3 LTS on WSL

Version

Version: 0.47.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-11-09 00:17:40.494427456 +0000 UTC
  NextUpdate: 2023-11-09 06:17:40.494427156 +0000 UTC
  DownloadedAt: 2023-11-09 03:37:45.067463491 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2023-11-08 01:03:36.920887743 +0000 UTC
  NextUpdate: 2023-11-11 01:03:36.920887243 +0000 UTC
  DownloadedAt: 2023-11-08 12:23:07.472191595 +0000 UTC

Checklist

• Run trivy image --reset
• Read the troubleshooting

[DmitriyLewen]

Hello @lmpeiris
Thanks for your report!

It looks like your template file is corrupt.
Are you using latest version of html.tpl file?

Regards, Dmitriy

[lmpeiris]

getting same error for current main branch (which was unchanged since 0.47.0) as well.

md5sum html.tpl
0386c469e96c6da65e833828864766cc html.tpl

[DmitriyLewen]

I see different checksum:

➜ wget https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/html.tpl
...

➜ md5sum html.tpl 
ab474d365ee042fd48172f3458b795cd html.tpl

Can you submit your template to check?

[lmpeiris]

Sorry for the inconvenience caused.
It looks like i ran wget directly on the guthub page, which added github site data in to the file ( i did a 'https://github.com/aquasecurity/trivy/blob/main/contrib/html.tpl' )
now its working.

This bug is invalid, i'm going to close it

[lmpeiris]

closing this bug as invalid