0.50.0 : big time increase of FS scanning vs 0.49.1

[jlamande]

Question

Scanning in a CI job with exactly the same setup (only changed the trivy version, scanned fs is the same).

With trivy 0.50.0 (done multiple times with equivalent durations)

time trivy fs --exit-code 0 --scanners vuln --ignore-unfixed "pom.xml"
2024-03-20T05:21:41.521Z	INFO	Vulnerability scanning is enabled
2024-03-20T05:25:47.917Z	INFO	Number of language-specific files: 1
2024-03-20T05:25:47.917Z	INFO	Detecting pom vulnerabilities...
pom.xml (pom)
=============
Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 4, CRITICAL: 0)
real	4m 7.63s
user	0m 12.08s
sys	0m 2.10s

With trivy 0.49.1 (done multiple times with equivalent durations)

time trivy fs --exit-code 0 --scanners vuln --ignore-unfixed "pom.xml"
2024-03-20T07:36:22.530Z	INFO	Vulnerability scanning is enabled
2024-03-20T07:36:30.896Z	INFO	Number of language-specific files: 1
2024-03-20T07:36:30.896Z	INFO	Detecting pom vulnerabilities...
pom.xml (pom)
=============
Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 4, CRITICAL: 0)

real	0m 9.59s
user	0m 6.63s
sys	0m 0.31s

Does anyone see the same behavior ?

Is there some new option to enable in 0.50 to avoid this time increase ?

Target

Filesystem

Scanner

Vulnerability

Output Format

None

Mode

Standalone

Operating System

Docker

Version

Version: 0.50.0

[DmitriyLewen]

Hello @jlamande
Thanks for your report!

We added support for repositories (#6171).
But looks like there are cases when pom files of dependencies contains incorrect links.
e.g. jackson-databind:

  <repositories>
    <repository>
      <id>sonatype-nexus-snapshots</id>
      <name>Sonatype Nexus Snapshots</name>
      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
      <releases><enabled>false</enabled></releases>
      <snapshots><enabled>true</enabled></snapshots>
    </repository>
  </repositories>

But it should be https://s01.oss.sonatype.org/content/repositories/snapshots.

Perhaps we need to add flag to enable/disable release and snapshot repositories for pom.xml files to avoid this issue.
@knqyf263 wdyt?

---

@jlamande As a workaround, you can download dependencies to local cache using the mvn dependency:resolve command before scanning the pom.xml file.

Regards, Dmitriy

[jlamande]

Unfortunately, in my context, I am scanning sources by using the aquasec/trivy image in a CI job. So I have no maven command immediately available.

[DmitriyLewen]

Perhaps there is a way to mount the maven cache directory to aquasec/trivy image in your CI?

[jlamande]

Effectively, could be a way. I will do a try.

Thank @DmitriyLewen for having taken time to answer.

[DmitriyLewen]

Created #6374 for this task.