fix(misconf): fix incorrect k8s locations due to JSON to YAML conversion

[nikpivkin]

Description

This PR uses github.com/go-json-experiment/json to parsing JSON manifests, which produces correct node positions, unlike the current approach where JSON is first converted to YAML and then parsed.

Before

AVD-KSV-0021 (LOW): Container 'hello' of Pod 'hello-cpu-limit' should set 'securityContext.runAsGroup' > 10000
════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

See https://avd.aquasec.com/misconfig/ksv021
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 test.json:7-12
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   7 ┌     "spec": {
   8 │         "containers": [
   9 │             {
  10 │                 "command": ["sh", "-c", "echo 'Hello' && sleep 1h"],
  11 │                 "image": "busybox",
  12 └                 "name": "hello"
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

After

AVD-KSV-0021 (LOW): Container 'hello' of Pod 'hello-cpu-limit' should set 'securityContext.runAsGroup' > 10000
════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

See https://avd.aquasec.com/misconfig/ksv021
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 test.json:8-13
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   8 ┌         "containers": [
   9 │             {
  10 │                 "command": ["sh", "-c", "echo 'Hello' && sleep 1h"],
  11 │                 "image": "busybox",
  12 │                 "name": "hello"
  13 └             }
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Related issues

• Close bug(misconf): Incorrect location of findings in k8s JSON scan #8072

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[github-actions]

This PR is stale because it has been labeled with inactivity.

[nikpivkin]

@simar7 Although this is an experimental package, it is already used in a lot of projects. Also recently opened a proposal to include this package in Go as encoding/json/v2. What do you think about using it?

[simar7]

@simar7 Although this is an experimental package, it is already used in a lot of projects. Also recently opened a proposal to include this package in Go as encoding/json/v2. What do you think about using it?

Interesting, I'm not opposed to it but I am curious if we can solve it with what's already there in stdlib or not.

[nikpivkin]

Currently, the encoding/json package does not provide a way to retrieve node positions.

[simar7]

lgtm just left one comment, @knqyf263 do you have any thoughts on this?

[simar7]

nit: Could we add a link to the Golang proposal here that would adopt this package? That way we can remove it once it gets upstreamed.

[nikpivkin]

Done 59db14e