ERROR [sarif] Unable to parse URI

[ZsoltPath]

Description

My TF code has module sources in GitHub repository using the [email protected]:rbs-path/terraform-modules.git/modules/... format.
https://developer.hashicorp.com/terraform/language/modules/sources#github
When running Trivy with Sarif output in GitHub worklfow it fails.

Desired Behavior

Sarif output created

Actual Behavior

trivy config --tf-vars environments/dev.tfvars --format sarif ./
.
.
.
ERROR   [sarif] Unable to parse URI     URI="[email protected]:rbs-path/terraform-modules.git/modules/compute/aws-lambda?ref=v3.8.0/.terraform/modules/cleanup/modules/compute/aws-lambda/cloudwatch.tf" err="parse \"[email protected]:rbs-path/terraform-modules.git/modules/compute/aws-lambda?ref=v3.8.0/.terraform/modules/cleanup/modules/compute/aws-lambda/cloudwatch.tf\": first path segment in URL cannot contain colon"

Reproduction Steps

1. Create TF module with `[email protected]:rbs-path/terraform-modules.git/modules/...` format source
2. Run `trivy config --format sarif ./`

Target

Filesystem

Scanner

Misconfiguration

Output Format

SARIF

Mode

Standalone

Debug Output

2024-11-08T12:44:10Z    ERROR   [sarif] Unable to parse URI     URI="[email protected]:rbs-path/terraform-modules.git/modules/compute/aws-lambda?ref=v3.8.0/.terraform/modules/cleanup/modules/compute/aws-lambda/cloudwatch.tf" err="parse \"[email protected]:rbs-path/terraform-modules.git/modules/compute/aws-lambda?ref=v3.8.0/.terraform/modules/cleanup/modules/compute/aws-lambda/cloudwatch.tf\": first path segment in URL cannot contain colon"
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x8 pc=0x104e940b4]

goroutine 1 [running]:
net/url.(*URL).String(0x1400a100840?)
        net/url/url.go:832 +0x24
github.com/aquasecurity/trivy/pkg/report.(*SarifWriter).addSarifResult(0x1400a100840, 0x1400647b880)
        github.com/aquasecurity/trivy/pkg/report/sarif.go:114 +0x310
github.com/aquasecurity/trivy/pkg/report.(*SarifWriter).Write(_, {_, _}, {0x2, {0xc1c39fc6adbcf818, 0x2e1c59355, 0x10e4738a0}, {0x16b17b6d6, 0x1}, {0x1091c1b1c, ...}, ...})
        github.com/aquasecurity/trivy/pkg/report/sarif.go:186 +0xedc
github.com/aquasecurity/trivy/pkg/report.Write({_, _}, {0x2, {0xc1c39fc6adbcf818, 0x2e1c59355, 0x10e4738a0}, {0x16b17b6d6, 0x1}, {0x1091c1b1c, 0xa}, ...}, ...)
        github.com/aquasecurity/trivy/pkg/report/writer.go:102 +0x79c
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).Report(_, {_, _}, {{{0x1091c1608, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:276 +0x84
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x1091c1608, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x14000345650, ...}, ...}, ...}, ...)
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:395 +0xa4c
github.com/aquasecurity/trivy/pkg/commands.NewConfigCommand.func2(0x1400169e908, {0x1400172e180, 0x1, 0x6})
        github.com/aquasecurity/trivy/pkg/commands/app.go:719 +0x294
github.com/spf13/cobra.(*Command).execute(0x1400169e908, {0x1400172e120, 0x6, 0x6})
        github.com/spf13/[email protected]/command.go:985 +0x834
github.com/spf13/cobra.(*Command).ExecuteC(0x14000269808)
        github.com/spf13/[email protected]/command.go:1117 +0x344
github.com/spf13/cobra.(*Command).Execute(0x109222de9?)
        github.com/spf13/[email protected]/command.go:1041 +0x1c
main.run()
        github.com/aquasecurity/trivy/cmd/trivy/main.go:39 +0x124
main.main()
        github.com/aquasecurity/trivy/cmd/trivy/main.go:19 +0x20

### Operating System

MacOS Sequia

### Version

```bash
Version: 0.57.0
Check Bundle:
  Digest: sha256:9cc30e6eb1c0dc0b4a4791b61c3dbff8799d08daeac893c08317e7b054ecab14
  DownloadedAt: 2024-11-08 12:26:50.842447 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

hi @ZsoltPath thanks for the report.

@DmitriyLewen we might have to cleanup the URI for sarif it seems as remote paths in terraform will have the protocol with them.

[DmitriyLewen]

@simar7 i overwrite [email protected] schema as for git::http/ schema - #7898
take a look, please.

[DmitriyLewen]

Created #7897 for this issue.

[ZsoltPath]

Thanks, guys!
Watching for the next release.