Description
Trivy fills fields from pom.xml file as properties (e.g. project.version, project.parent.version, etc.)
But when there are nested parents - Trivy takes incorrect values.
Example
- Current logic - Trivy detects
parent.version in parent2 (empty value) and uses this value for other pom files (parent1, scanned pom.xml).
- Correct logic - use first non empty value (
1.0.0 from scanned pom.xml file).
See test example here - DmitriyLewen@3f5f697#r160365412
Discussed in #9039
Description
Trivy fills fields from pom.xml file as properties (e.g.
project.version,project.parent.version, etc.)But when there are nested parents - Trivy takes incorrect values.
Example
parent.versioninparent2(empty value) and uses this value for other pom files (parent1, scanned pom.xml).1.0.0from scanned pom.xml file).See test example here - DmitriyLewen@3f5f697#r160365412
Discussed in #9039