Whitespace Characters Detected Inside pom.xml Dependency Tags as Part of the Dependency Name

[MorAlon1]

Description

It appears that Maven dependencies containing whitespace characters are detected in Trivy with the whitespace included as part of the name.

Desired Behavior

I have the following pom.xml:

<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <modelVersion>4.0.0</modelVersion>
  <groupId>aquq.com</groupId>
  <artifactId>leistung-prototyp</artifactId>
  <version>1.0.0-SNAPSHOT</version>
  <dependencies>
    <dependency>
      <groupId>
      
      
      io.quarkus</groupId>
      <artifactId>quarkus-resteasy-reactive-jackson</artifactId>
      <version>2.2.3</version>
    </dependency>
  </dependencies>
  <build>
    <sourceDirectory>src/main/java</sourceDirectory>
    <testSourceDirectory>src/test/java</testSourceDirectory>
    <plugins>
      <plugin>
        <groupId>${quarkus.platform.group-id}</groupId>
        <artifactId>quarkus-maven-plugin</artifactId>
        <version>${quarkus.platform.version}</version>
        <extensions>true</extensions>
        <executions>
          <execution>
            <goals>
              <goal>build</goal>
              <goal>generate-code</goal>
              <goal>generate-code-tests</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>${compiler-plugin.version}</version>
        <configuration>
          <compilerArgs>
            <arg>-parameters</arg>
          </compilerArgs>
        </configuration>
      </plugin>
      <plugin>
        <artifactId>maven-surefire-plugin</artifactId>
        <version>${surefire-plugin.version}</version>
        <configuration>
          <systemPropertyVariables>
            <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
            <maven.home>${maven.home}</maven.home>
          </systemPropertyVariables>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-failsafe-plugin</artifactId>
        <configuration>
          <systemPropertyVariables>
            <native.image.path>${project.build.directory}/${project.build.finalName}-runner</native.image.path>
            <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
            <maven.home>${maven.home}</maven.home>
          </systemPropertyVariables>
          <groups>native,native-only</groups>
          <excludedGroups>non-native</excludedGroups>
        </configuration>
      </plugin>
    </plugins>
  </build>
  <profiles>
    <profile>
      <id>native</id>
      <activation>
        <property>
          <name>native</name>
        </property>
      </activation>
      <properties>
        <skipITs>false</skipITs>
        <quarkus.package.type>native</quarkus.package.type>
      </properties>
    </profile>
  </profiles>
</project>

When I run the following command:
trivy fs --list-all-pkgs --format json .
I expect to see the following dependency in the output:

{
  "ID": "io.quarkus:quarkus-resteasy-reactive-jackson:2.2.3",
  "Name": "io.quarkus:quarkus-resteasy-reactive-jackson",
  "Version": "2.2.3"
}

Actual Behavior

My output contains the desired dependency in the following way:

        {
          "ID": "\n      \n      \n      io.quarkus:quarkus-resteasy-reactive-jackson:2.2.3",
          "Name": "\n      \n      \n      io.quarkus:quarkus-resteasy-reactive-jackson",
          "Identifier": {
            "PURL": "pkg:maven/%0A%20%20%20%20%20%20%0A%20%20%20%20%20%20%0A%20%20%20%20%20%20io.quarkus/[email protected]",
            "UID": "8693d7b8cf7bb552"
          },
          "Version": "2.2.3",
          "Relationship": "direct",
          "Layer": {},
          "Locations": [
            {
              "StartLine": 9,
              "EndLine": 16
            }
          ]
        }

Reproduction Steps

1. Run ` fs --list-all-pkgs --format json .` for project containing the pom.xml

Target

Filesystem

Scanner

None

Output Format

JSON

Mode

Standalone

Debug Output

2024-10-15T11:45:50+03:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2024-10-15T11:45:50+03:00	DEBUG	Cache dir	dir="/Users/moralon/Library/Caches/trivy"
2024-10-15T11:45:50+03:00	DEBUG	Cache dir	dir="/Users/moralon/Library/Caches/trivy"
2024-10-15T11:45:50+03:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-10-15T11:45:50+03:00	DEBUG	Ignore statuses	statuses=[]
2024-10-15T11:45:50+03:00	DEBUG	DB update was skipped because the local DB was downloaded during the last hour
2024-10-15T11:45:50+03:00	DEBUG	DB info	schema=2 updated_at=2024-10-14T00:19:40.198722045Z next_update=2024-10-15T00:19:40.198721795Z downloaded_at=2024-10-15T08:05:17.068538Z
2024-10-15T11:45:50+03:00	DEBUG	[pkg] Package types	types=[os library]
2024-10-15T11:45:50+03:00	DEBUG	[pkg] Package relationships	relationships=[unknown root direct indirect]
2024-10-15T11:45:50+03:00	INFO	[vuln] Vulnerability scanning is enabled
2024-10-15T11:45:50+03:00	INFO	[secret] Secret scanning is enabled
2024-10-15T11:45:50+03:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-15T11:45:50+03:00	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-15T11:45:50+03:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-10-15T11:45:50+03:00	DEBUG	Initializing scan cache...	type="memory"
2024-10-15T11:45:50+03:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2024-10-15T11:45:50+03:00	DEBUG	Skipping path	path=".git"
2024-10-15T11:45:50+03:00	DEBUG	[pom] Resolving...	group_id="\n      \n      \n      io.quarkus" artifact_id="quarkus-resteasy-reactive-jackson" version="2.2.3"
2024-10-15T11:45:50+03:00	DEBUG	[pom] Failed to fetch	url="https://repo.maven.apache.org/maven2/%0A%20%20%20%20%20%20%0A%20%20%20%20%20%20%0A%20%20%20%20%20%20io/quarkus/quarkus-resteasy-reactive-jackson/2.2.3/quarkus-resteasy-reactive-jackson-2.2.3.pom" statusCode=404
2024-10-15T11:45:50+03:00	DEBUG	[pom] Repository error	err="\n      \n      \n      io.quarkus:quarkus-resteasy-reactive-jackson:2.2.3 was not found in local/remote repositories"
2024-10-15T11:45:50+03:00	DEBUG	OS is not detected.
2024-10-15T11:45:50+03:00	DEBUG	Detected OS: unknown
2024-10-15T11:45:50+03:00	INFO	Number of language-specific files	num=1
2024-10-15T11:45:50+03:00	INFO	[pom] Detecting vulnerabilities...
2024-10-15T11:45:50+03:00	DEBUG	[pom] Scanning packages for vulnerabilities	file_path="pom.xml"
2024-10-15T11:45:50+03:00	DEBUG	[vex] VEX filtering is disabled
{
  "SchemaVersion": 2,
  "CreatedAt": "2024-10-15T11:45:50.743426+03:00",
  "ArtifactName": ".",
  "ArtifactType": "filesystem",
  "Metadata": {
    "ImageConfig": {
      "architecture": "",
      "created": "0001-01-01T00:00:00Z",
      "os": "",
      "rootfs": {
        "type": "",
        "diff_ids": null
      },
      "config": {}
    }
  },
  "Results": [
    {
      "Target": "pom.xml",
      "Class": "lang-pkgs",
      "Type": "pom",
      "Packages": [
        {
          "ID": "aquq.com:leistung-prototyp:1.0.0-SNAPSHOT",
          "Name": "aquq.com:leistung-prototyp",
          "Identifier": {
            "PURL": "pkg:maven/aquq.com/[email protected]",
            "UID": "321f0bfef922a7fb"
          },
          "Version": "1.0.0-SNAPSHOT",
          "Relationship": "root",
          "DependsOn": [
            "\n      \n      \n      io.quarkus:quarkus-resteasy-reactive-jackson:2.2.3"
          ],
          "Layer": {}
        },
        {
          "ID": "\n      \n      \n      io.quarkus:quarkus-resteasy-reactive-jackson:2.2.3",
          "Name": "\n      \n      \n      io.quarkus:quarkus-resteasy-reactive-jackson",
          "Identifier": {
            "PURL": "pkg:maven/%0A%20%20%20%20%20%20%0A%20%20%20%20%20%20%0A%20%20%20%20%20%20io.quarkus/[email protected]",
            "UID": "8693d7b8cf7bb552"
          },
          "Version": "2.2.3",
          "Relationship": "direct",
          "Layer": {},
          "Locations": [
            {
              "StartLine": 9,
              "EndLine": 16
            }
          ]
        }
      ]
    }
  ]
}

Operating System

macOS

Version

Version: 0.56.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-10-14 00:19:40.198722045 +0000 UTC
  NextUpdate: 2024-10-15 00:19:40.198721795 +0000 UTC
  DownloadedAt: 2024-10-15 08:05:17.068538 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-08-18 01:07:02.08653507 +0000 UTC
  NextUpdate: 2024-08-21 01:07:02.08653491 +0000 UTC
  DownloadedAt: 2024-08-18 08:47:08.228676 +0000 UTC
Check Bundle:
  Digest: sha256:ef2d9ad4fce0f933b20a662004d7e55bf200987c180e7f2cd531af631f408bb3
  DownloadedAt: 2024-10-15 08:05:17.923803 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

Is it different from this issue?
#7658