Dependencies without versions in the pom.xml file are not detected

[MorAlon1]

Description

I have the following pom.xml in my repository:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <properties>
    <swagger.annotations.version>1.6.14</swagger.annotations.version>
    <swagger.annotations.v3.version>2.2.22</swagger.annotations.v3.version>
  </properties>

  <dependencies>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-webflux</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-websocket</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-data-jdbc</artifactId>
    </dependency>
    <dependency>
      <groupId>org.postgresql</groupId>
      <artifactId>postgresql</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.kafka</groupId>
      <artifactId>spring-kafka</artifactId>
    </dependency>
    <dependency>
      <groupId>io.swagger</groupId>
      <artifactId>swagger-annotations</artifactId>
      <version>${swagger.annotations.version}</version>
    </dependency>
  </dependencies>
</project>

When I run trivy fs --list-all-pkgs --format json . command on the root folder, I only get the dependencies that include versions in the pom.xml file.

Desired Behavior

Getting all the dependencies, including those without versions.

Actual Behavior

Only getting dependencies that have versions in the pom.xml

Reproduction Steps

run `trivy fs --list-all-pkgs --format json .` for the attached file

Target

Filesystem

Scanner

None

Output Format

JSON

Mode

None

Debug Output

2024-07-25T17:15:37+03:00	DEBUG	Cache dir	dir="/Users/moralon/Library/Caches/trivy"
2024-07-25T17:15:37+03:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-07-25T17:15:37+03:00	DEBUG	Ignore statuses	statuses=[]
2024-07-25T17:15:37+03:00	DEBUG	DB update was skipped because the local DB is the latest
2024-07-25T17:15:37+03:00	DEBUG	DB info	schema=2 updated_at=2024-07-25T12:12:34.331679491Z next_update=2024-07-25T18:12:34.33167922Z downloaded_at=2024-07-25T12:17:09.838615Z
2024-07-25T17:15:37+03:00	INFO	Vulnerability scanning is enabled
2024-07-25T17:15:37+03:00	DEBUG	Vulnerability type	type=[os library]
2024-07-25T17:15:37+03:00	INFO	Secret scanning is enabled
2024-07-25T17:15:37+03:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-07-25T17:15:37+03:00	INFO	Please see also https://aquasecurity.github.io/trivy/v0.53/docs/scanner/secret#recommendation for faster secret detection
2024-07-25T17:15:37+03:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-07-25T17:15:37+03:00	DEBUG	Initializing scan cache...	type="memory"
2024-07-25T17:15:37+03:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2024-07-25T17:15:37+03:00	DEBUG	[nuget] The nuget packages directory couldn't be found. License search disabled
2024-07-25T17:15:37+03:00	DEBUG	Skipping path	path=".git"
2024-07-25T17:15:37+03:00	DEBUG	[pom] Resolving...	group_id="org.springframework.boot" artifact_id="spring-boot-starter-webflux" version=""
2024-07-25T17:15:37+03:00	DEBUG	[pom] Repository error	err="Version missing for org.springframework.boot:spring-boot-starter-webflux"
2024-07-25T17:15:37+03:00	DEBUG	[pom] Resolving...	group_id="org.springframework.boot" artifact_id="spring-boot-starter-websocket" version=""
2024-07-25T17:15:37+03:00	DEBUG	[pom] Repository error	err="Version missing for org.springframework.boot:spring-boot-starter-websocket"
2024-07-25T17:15:37+03:00	DEBUG	[pom] Resolving...	group_id="org.springframework.boot" artifact_id="spring-boot-starter-data-jdbc" version=""
2024-07-25T17:15:37+03:00	DEBUG	[pom] Repository error	err="Version missing for org.springframework.boot:spring-boot-starter-data-jdbc"
2024-07-25T17:15:37+03:00	DEBUG	[pom] Resolving...	group_id="org.postgresql" artifact_id="postgresql" version=""
2024-07-25T17:15:37+03:00	DEBUG	[pom] Repository error	err="Version missing for org.postgresql:postgresql"
2024-07-25T17:15:37+03:00	DEBUG	[pom] Resolving...	group_id="org.springframework.kafka" artifact_id="spring-kafka" version=""
2024-07-25T17:15:37+03:00	DEBUG	[pom] Repository error	err="Version missing for org.springframework.kafka:spring-kafka"
2024-07-25T17:15:37+03:00	DEBUG	[pom] Resolving...	group_id="io.swagger" artifact_id="swagger-annotations" version="1.6.14"
2024-07-25T17:15:37+03:00	DEBUG	[pom] Start parent	artifact="io.swagger:swagger-project:1.6.14"
2024-07-25T17:15:37+03:00	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:5"
2024-07-25T17:15:37+03:00	DEBUG	[pom] Adding repository	id="sonatype-nexus-snapshots" url="https://oss.sonatype.org/content/repositories/snapshots"
2024-07-25T17:15:37+03:00	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:5"
2024-07-25T17:15:37+03:00	DEBUG	[pom] Exit parent	artifact="io.swagger:swagger-project:1.6.14"
2024-07-25T17:15:37+03:00	DEBUG	OS is not detected.
2024-07-25T17:15:37+03:00	DEBUG	Detected OS: unknown
2024-07-25T17:15:37+03:00	INFO	Number of language-specific files	num=1
2024-07-25T17:15:37+03:00	INFO	[pom] Detecting vulnerabilities...
2024-07-25T17:15:37+03:00	DEBUG	[pom] Scanning packages for vulnerabilities	file_path="pom.xml"
{
  "SchemaVersion": 2,
  "CreatedAt": "2024-07-25T17:15:37.435303+03:00",
  "ArtifactName": ".",
  "ArtifactType": "filesystem",
  "Metadata": {
    "ImageConfig": {
      "architecture": "",
      "created": "0001-01-01T00:00:00Z",
      "os": "",
      "rootfs": {
        "type": "",
        "diff_ids": null
      },
      "config": {}
    }
  },
  "Results": [
    {
      "Target": "pom.xml",
      "Class": "lang-pkgs",
      "Type": "pom",
      "Packages": [
        {
          "ID": "io.swagger:swagger-annotations:1.6.14",
          "Name": "io.swagger:swagger-annotations",
          "Identifier": {
            "PURL": "pkg:maven/io.swagger/[email protected]",
            "UID": "c7207a0f06f4239e"
          },
          "Version": "1.6.14",
          "Licenses": [
            "Apache-2.0"
          ],
          "Relationship": "direct",
          "Layer": {},
          "Locations": [
            {
              "StartLine": 31,
              "EndLine": 35
            }
          ]
        }
      ]
    }
  ]
}

Operating System

macOS

Version

Version: 0.53.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-07-25 12:12:34.331679491 +0000 UTC
  NextUpdate: 2024-07-25 18:12:34.33167922 +0000 UTC
  DownloadedAt: 2024-07-25 12:17:09.838615 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-06-23 01:04:54.158373366 +0000 UTC
  NextUpdate: 2024-06-26 01:04:54.158373196 +0000 UTC
  DownloadedAt: 2024-06-23 11:49:34.351796 +0000 UTC
Check Bundle:
  Digest: sha256:ef2d9ad4fce0f933b20a662004d7e55bf200987c180e7f2cd531af631f408bb3
  DownloadedAt: 2024-07-25 12:17:10.842726 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

They are not supported now.

[tamirkiviti13]

Is there any plan to support those kinds of dependencies?

[knqyf263]

If the version is not specified, it means we need to identify the version, but Maven's version selection is complex and we're not sure if it can be implemented.

Similar to sbt, we may be able to parse the output from other plugins.

e.g., (NOTE: I've never tested)

$ mvn dependency:tree -DoutputType=json -DoutputFile=dependency-tree.json

[MorAlon1]

is there an option to identify a dependency with 'unknown' as the version?

[knqyf263]

It's possible, but we cannot identify the transitive dependencies of the dependency.

[bedla]

Maybe using https://github.com/CycloneDX/cyclonedx-maven-plugin and generating SBOM might solve your problem (SBOM JSON contains correct versions).

[DmitriyLewen]

Hello @MorAlon1
I checked your pom.xml file.
We try to reproduce logic of language utilities (mvn in this case).
But mvn returns error about version of dependencies for your test file (I added artifactID, groupID and Version fields into test file from issue to skip errors about these fields):

➜  7231 mvn dependency:tree
[INFO] Scanning for projects...
[ERROR] [ERROR] Some problems were encountered while processing the POMs:
[ERROR] 'dependencies.dependency.version' for org.springframework.boot:spring-boot-starter-webflux:jar is missing. @ line 16, column 17
[ERROR] 'dependencies.dependency.version' for org.springframework.boot:spring-boot-starter-websocket:jar is missing. @ line 20, column 17
[ERROR] 'dependencies.dependency.version' for org.springframework.boot:spring-boot-starter-data-jdbc:jar is missing. @ line 24, column 17
[ERROR] 'dependencies.dependency.version' for org.postgresql:postgresql:jar is missing. @ line 28, column 17
[ERROR] 'dependencies.dependency.version' for org.springframework.kafka:spring-kafka:jar is missing. @ line 32, column 17

If mvn doesn't work, it doesn't make sense Trivy does.

Maybe you could share more details about your use case?

[knqyf263]

Created #7446