Incorrect location of findings in k8s JSON scan

[nikpivkin]

Description

The scan result contains incorrect misconfiguration locations. The reason is that json is converted to yaml before scanning, so the locations correspond to yaml.

Desired Behavior

correct location

Actual Behavior

incorrect location

Reproduction Steps

❯ cat test.json
{
    "apiVersion": "v1",
    "kind": "Pod",
    "metadata": {
      "name": "hello-cpu-limit"
    },
    "spec": {
      "containers": [
        {
          "command": [
            "sh",
            "-c",
            "echo 'Hello' && sleep 1h"
          ],
          "image": "busybox",
          "name": "hello"
        }
      ]
    }
  }%

❯ trivy conf test.json
...
LOW: container should drop all
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.

See https://avd.aquasec.com/misconfig/ksv106
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 test.json:7-12
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   7 ┌     "spec": {
   8 │       "containers": [
   9 │         {
  10 │           "command": [
  11 │             "sh",
  12 └             "-c",
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
...

❯ cat test.yaml
apiVersion: v1
kind: Pod
metadata:
  name: hello-cpu-limit
spec:
  containers:
  - command:
    - sh
    - "-c"
    - echo 'Hello' && sleep 1h
    image: busybox
    name: hello

❯ trivy conf test.yaml
...
LOW: container should drop all
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.

See https://avd.aquasec.com/misconfig/ksv106
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 test.yaml:7-12
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   7 ┌   - command:
   8 │     - sh
   9 │     - "-c"
  10 │     - echo 'Hello' && sleep 1h
  11 │     image: busybox
  12 └     name: hello
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
...

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

-

Operating System

macos

Version

Version: 0.56.1

Checklist

• Run trivy clean --all
• Read the troubleshooting