Trivy Parser Creates Malformed Location URL about securecodebox HOT 4 OPEN

Hi @danil-smirnov,

thanks for submitting this issue. We'll investigate this.

from securecodebox.

Hi @danil-smirnov

Good point, the trivy-k8s sets the location to a invalid uri. Thank you for reporting it.

We need to chagne this to a format which is URI compliant, but it'll be hard to fit all of the information in there.

https://github.com/secureCodeBox/secureCodeBox/blob/main/scanners/trivy/parser/parser.js#L175

from securecodebox.

We need to define a valid URL format for the docker image. As discussed today we need to do some research what a good spec is. Some ideas:

• Simply the HTTP URL from where the image was puled: https://registry.example.com/foo/imagename/latest
• K8s may have something similar like: docker-pulable://....
• Define a custom protocol: x-scb-trivy://....

from securecodebox.