-
Notifications
You must be signed in to change notification settings - Fork 2.8k
Closed
Labels
kind/bugCategorizes issue or PR as related to a bug.Categorizes issue or PR as related to a bug.scan/misconfigurationIssues relating to misconfiguration scanningIssues relating to misconfiguration scanning
Description
Trivy panics when a value used as an ignore marker is either null or unknown.
Before performing any operations on such a value, we should validate that it is both non-null and known. If the value cannot be resolved at evaluation time, the rule should safely skip it instead of causing a panic.
Steps to reproduce
-
Use the following Terraform configuration:
#trivy:ignore:*[bucket=mybucket-bucket1] resource "aws_s3_bucket" "test" { bucket = "mybucket-${each.key}" }
-
Run Trivy against this file.
Because the value used as the ignore marker (mybucket-${each.key}) is unknown during evaluation, Trivy attempts to process it and panics instead of handling it gracefully.
Discussed in #9601
Metadata
Metadata
Assignees
Labels
kind/bugCategorizes issue or PR as related to a bug.Categorizes issue or PR as related to a bug.scan/misconfigurationIssues relating to misconfiguration scanningIssues relating to misconfiguration scanning