Inline Ignore comment not working

[HariSekhon]

Description

Trivy's inline rule ignore comment does not seem to be working.

I am trying to ignore an AWS sample access key but trivy keeps flagging it.

Desired Behavior

Expected trivy to ignore the line after the comment.

Actual Behavior

Still reports the sample AWS access key

Reproduction Steps

$ wget https://raw.githubusercontent.com/HariSekhon/DevOps-Bash-tools/master/.gitconfig

$ trivy fs .gitconfig
2023-05-13T03:28:25.646+0100    INFO    Vulnerability scanning is enabled
2023-05-13T03:28:25.646+0100    INFO    Secret scanning is enabled
2023-05-13T03:28:25.646+0100    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-05-13T03:28:25.646+0100    INFO    Please see also https://aquasecurity.github.io/trivy/v0.41/docs/secret/scanning/#recommendation for faster secret detection
2023-05-13T03:28:25.697+0100    INFO    Number of language-specific files: 0

/.gitconfig (secrets)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

CRITICAL: AWS (aws-access-key-id)
════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
AWS Access Key ID
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 /.gitconfig:226
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 224       # These are sample keys so ignore false positives from scanning tools
 225       # trivy:ignore:aws-access-key-id
 226 [     allowed = ********************
 227       # trivy:ignore:aws-access-key-id
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Target

Filesystem

Scanner

Secret

Output Format

Table

Mode

Standalone

Debug Output

$ trivy fs .gitconfig --debug
2023-05-13T03:31:39.969+0100    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-05-13T03:31:40.163+0100    DEBUG   cache dir:  /Users/hari/Library/Caches/trivy
2023-05-13T03:31:40.163+0100    DEBUG   DB update was skipped because the local DB is the latest
2023-05-13T03:31:40.163+0100    DEBUG   DB Schema: 2, UpdatedAt: 2023-05-13 00:10:43.929289643 +0000 UTC, NextUpdate: 2023-05-13 06:10:43.929289243 +0000 UTC, DownloadedAt: 2023-05-13 02:09:01.035514 +0000 UTC
2023-05-13T03:31:40.178+0100    INFO    Vulnerability scanning is enabled
2023-05-13T03:31:40.178+0100    DEBUG   Vulnerability type:  [os library]
2023-05-13T03:31:40.178+0100    INFO    Secret scanning is enabled
2023-05-13T03:31:40.178+0100    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-05-13T03:31:40.178+0100    INFO    Please see also https://aquasecurity.github.io/trivy/v0.41/docs/secret/scanning/#recommendation for faster secret detection
2023-05-13T03:32:06.429+0100    DEBUG   No secret config detected: trivy-secret.yaml
2023-05-13T03:32:06.535+0100    DEBUG   Walk the file tree rooted at '.gitconfig' in parallel
2023-05-13T03:32:07.200+0100    DEBUG   OS is not detected.
2023-05-13T03:32:07.200+0100    DEBUG   Detected OS: unknown
2023-05-13T03:32:07.200+0100    INFO    Number of language-specific files: 0
2023-05-13T03:32:07.200+0100    DEBUG   Secret file: /.gitconfig

/.gitconfig (secrets)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

CRITICAL: AWS (aws-access-key-id)
════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
AWS Access Key ID
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 /.gitconfig:226
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 224       # These are sample keys so ignore false positives from scanning tools
 225       # trivy:ignore:aws-access-key-id
 226 [     allowed = ********************
 227       # trivy:ignore:aws-access-key-id
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Operating System

macOS Big Sur

Version

Version: 0.41.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-05-13 00:10:43.929289643 +0000 UTC
  NextUpdate: 2023-05-13 06:10:43.929289243 +0000 UTC
  DownloadedAt: 2023-05-13 02:09:01.035514 +0000 UTC
Policy Bundle:
  Digest: sha256:97988c6fc189faa28aa7fc2fc93fb2605c46d2f6ae4092a70e03697ba1d6e620
  DownloadedAt: 2023-05-12 21:53:31.656932 +0000 UTC

Checklist

• Run trivy --reset
• Read the troubleshooting

[itaysk]

As the docs states, inline ignores currently apply to misconfiguration scanning only https://aquasecurity.github.io/trivy/v0.41/docs/configuration/filtering/#by-inline-comments

I'll convert this to a feature request