Trivy panics when a value used as an ignore marker is either null or unknown.
Before performing any operations on such a value, we should validate that it is both non-null and known. If the value cannot be resolved at evaluation time, the rule should safely skip it instead of causing a panic.
Steps to reproduce
-
Use the following Terraform configuration:
#trivy:ignore:*[bucket=mybucket-bucket1]
resource "aws_s3_bucket" "test" {
bucket = "mybucket-${each.key}"
}
-
Run Trivy against this file.
Because the value used as the ignore marker (mybucket-${each.key}) is unknown during evaluation, Trivy attempts to process it and panics instead of handling it gracefully.
Discussed in #9601
Trivy panics when a value used as an ignore marker is either null or unknown.
Before performing any operations on such a value, we should validate that it is both non-null and known. If the value cannot be resolved at evaluation time, the rule should safely skip it instead of causing a panic.
Steps to reproduce
Use the following Terraform configuration:
Run Trivy against this file.
Because the value used as the ignore marker (
mybucket-${each.key}) is unknown during evaluation, Trivy attempts to process it and panics instead of handling it gracefully.Discussed in #9601