trivy doesn't support secrets in templates

[puls-com-leon-komarovsky]

Description

Currently junit.tpl, html.tpl, and gitlab.tpl templates do not generate information about detected secrets, creating confusion when there are actual secrets found by trivy do not appear in reports.

Desired Behavior

Secrets are consistently shown in reports generated from provided templates.

Actual Behavior

Secrets are not shown in reports generated from some provided templates.

Reproduction Steps

mkdir -p trivy-secrets-test/source
cd trivy-secrets-test
curl -O https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/junit.tpl
echo -e "AWS_ACCESS_KEY_ID=AKIA2OGYBAH6TDQ3GH4E\nAWS_SECRET_ACCESS_KEY=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" > source/.env

trivy repo --scanners secret --format template --template "@./junit.tpl" --output ./test-secrets.xml ./source

Target

Git Repository

Scanner

Secret

Output Format

Template

Mode

Standalone

Debug Output

2024-07-30T15:39:34+01:00	DEBUG	Cache dir	dir="/Users/null/Library/Caches/trivy"
2024-07-30T15:39:34+01:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-07-30T15:39:34+01:00	DEBUG	Ignore statuses	statuses=[]
2024-07-30T15:39:34+01:00	INFO	Secret scanning is enabled
2024-07-30T15:39:34+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-07-30T15:39:34+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/v0.53/docs/scanner/secret#recommendation for faster secret detection
2024-07-30T15:39:34+01:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-07-30T15:39:34+01:00	DEBUG	Initializing scan cache...	type="memory"
2024-07-30T15:39:34+01:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2024-07-30T15:39:34+01:00	DEBUG	[nuget] The nuget packages directory couldn't be found. License search disabled
2024-07-30T15:39:34+01:00	DEBUG	OS is not detected.
2024-07-30T15:39:34+01:00	DEBUG	Secret file	path="source/.env"

Operating System

macOS Sonoma

Version

Version: 0.53.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-07-30 12:12:07.684956996 +0000 UTC
  NextUpdate: 2024-07-30 18:12:07.684956836 +0000 UTC
  DownloadedAt: 2024-07-30 14:05:32.382024 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-07-25 01:03:55.256191909 +0000 UTC
  NextUpdate: 2024-07-28 01:03:55.256191789 +0000 UTC
  DownloadedAt: 2024-07-25 12:59:24.109206 +0000 UTC
Check Bundle:
  Digest: sha256:ef2d9ad4fce0f933b20a662004d7e55bf200987c180e7f2cd531af631f408bb3
  DownloadedAt: 2024-07-29 14:18:14.169988 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[TicianoH]

I'm having the same issue

[DmitriyLewen]

Hello!

scanToHtml plugin supports secrets

As said here - we are gradually moving away from contrib templates in favor of plugins