Trivy gets fatal error and fails when trying to parse azure ARM templates for misconfigurations scan

[tamirkiviti13]

Description

Trivy fails when trying to parse Azure ARM templates for scanning

Desired Behavior

Trivy should parse the templates and scan them for misconfigurations

Actual Behavior

Trivy gets Fatal error when trying to parse the templates

Reproduction Steps

1. git clone https://github.com/Azure/azure-quickstart-templates
2. cd azure-quickstart-templates
3. trivy fs --debug  --scanners misconfig .

Target

Filesystem

Scanner

Misconfiguration

Output Format

None

Mode

None

Debug Output

trivy fs --debug  --scanners misconfig .
2025-03-05T21:41:21+02:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-03-05T21:41:21+02:00	DEBUG	Cache dir	dir="/Users/tamirkiviti/Library/Caches/trivy"
2025-03-05T21:41:21+02:00	DEBUG	Cache dir	dir="/Users/tamirkiviti/Library/Caches/trivy"
2025-03-05T21:41:21+02:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-03-05T21:41:21+02:00	DEBUG	Ignore statuses	statuses=[]
2025-03-05T21:41:21+02:00	INFO	[misconfig] Misconfiguration scanning is enabled
2025-03-05T21:41:21+02:00	DEBUG	[misconfig] Checks successfully loaded from disk
2025-03-05T21:41:21+02:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-03-05T21:41:21+02:00	DEBUG	Initializing scan cache...	type="memory"
2025-03-05T21:41:21+02:00	DEBUG	[fs] Analyzing...	root="."
2025-03-05T21:41:26+02:00	DEBUG	[fs] Using the latest commit hash for calculating cache key	commit_hash="6aa20360bae15b9cfb83860cc6e934f38b3fda6c"
2025-03-05T21:41:27+02:00	DEBUG	Skipping path	path=".git"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Resolving...	group_id="com.hazelcast" artifact_id="hazelcast-azure" version="2.0"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Resolving...	group_id="mysql" artifact_id="mysql-connector-java" version="8.0.28"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Resolving...	group_id="com.google.protobuf" artifact_id="protobuf-java" version="3.11.4"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Resolving...	group_id="com.hazelcast" artifact_id="hazelcast" version="5.3.5"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Start parent	artifact="com.google.protobuf:protobuf-parent:3.11.4"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Exit parent	artifact="com.google.protobuf:protobuf-parent:3.11.4"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Resolving...	group_id="com.google.protobuf" artifact_id="protobuf-bom" version="3.11.4"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Start parent	artifact="com.hazelcast:hazelcast-root:5.3.5"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Exit parent	artifact="com.hazelcast:hazelcast-root:5.3.5"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Resolving...	group_id="com.fasterxml.jackson" artifact_id="jackson-bom" version="2.15.2"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Adding repository	id="sonatype-nexus-snapshots" url="https://oss.sonatype.org/content/repositories/snapshots"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Start parent	artifact="com.fasterxml.jackson:jackson-parent:2.15"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Start parent	artifact="com.fasterxml:oss-parent:50"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Exit parent	artifact="com.fasterxml:oss-parent:50"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Exit parent	artifact="com.fasterxml.jackson:jackson-parent:2.15"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Resolving...	group_id="org.eclipse.jetty" artifact_id="jetty-bom" version="9.4.51.v20230217"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Resolving...	group_id="io.netty" artifact_id="netty-bom" version="4.1.100.Final"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:7"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:7"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Resolving...	group_id="com.google.protobuf" artifact_id="protobuf-bom" version="3.22.1"
2025-03-05T21:41:27+02:00	DEBUG	[pom] Resolving...	group_id="io.grpc" artifact_id="grpc-bom" version="1.58.0"
2025-03-05T21:41:28+02:00	DEBUG	[pom] Resolving...	group_id="com.google.auth" artifact_id="google-auth-library-bom" version="1.16.1"
2025-03-05T21:41:28+02:00	DEBUG	[pom] Resolving...	group_id="com.google.http-client" artifact_id="google-http-client-bom" version="1.43.1"
2025-03-05T21:41:28+02:00	DEBUG	[pom] Resolving...	group_id="com.google.oauth-client" artifact_id="google-oauth-client-bom" version="1.34.1"
2025-03-05T21:41:28+02:00	INFO	[npm] To collect the license information of packages, "npm install" needs to be performed beforehand	dir="application-workloads/jenkins/jenkins-cicd-container/node_modules"
2025-03-05T21:41:30+02:00	DEBUG	[misconfig] Scanning files for misconfigurations...	scanner="Azure ARM"
2025-03-05T21:41:30+02:00	FATAL	Fatal error
  - fs scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:402
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:261
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:629
  - failed analysis:
    github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact
        github.com/aquasecurity/trivy/pkg/scanner/scan.go:158
  - post analysis error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect
        github.com/aquasecurity/trivy/pkg/fanal/artifact/local/fs.go:205
  - post analysis error:
    github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze
        github.com/aquasecurity/trivy/pkg/fanal/analyzer/analyzer.go:510
  - azure-arm scan error:
    github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze
        github.com/aquasecurity/trivy/pkg/fanal/analyzer/config/config.go:46
  - scan config error:
    github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan
        github.com/aquasecurity/trivy/pkg/misconf/scanner.go:158
  - failed to parse template: invalid target type

Operating System

macOS sonoma

Version

trivy --version
Version: 0.59.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-02-19 12:18:27.677573356 +0000 UTC
  NextUpdate: 2025-02-20 12:18:27.677573095 +0000 UTC
  DownloadedAt: 2025-02-19 13:46:40.714794 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2025-02-04 04:21:21.794659617 +0000 UTC
  NextUpdate: 2025-02-07 04:21:21.794659356 +0000 UTC
  DownloadedAt: 2025-02-04 12:46:16.113962 +0000 UTC
Check Bundle:
  Digest: sha256:2bc834fc222789e26b85dc3e92e3333b488e16a9bfa192aa971cca25db884837
  DownloadedAt: 2025-03-05 19:35:23.028222 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

hi @tamirkiviti13 - looks like the arm parser isn't happy. @nikpivkin could you take a look, I think the implementation of armjsonUnmarshal needs to be improved.

[nikpivkin]

Track #8500