Inconsistent rendering of vulnerability Status

[piotrminkina]

Description

When rendering a vulnerability report via a custom template, you can get different output formats for the Status field. Sometimes you can get a descriptive status, and sometimes you can get it in numeric form.

Desired Behavior

Rendering of descriptive status in each case.

Actual Behavior

Examples:

$ trivy convert --format template --template '{{ toPrettyJson . }}' report.json | grep Status | head -n 1
        "Status": "fixed",

$ trivy convert --format template --template '{{ range . }}{{ toPrettyJson . }}{{ end }}' report.json | grep Status | head -n 1
      "Status": "fixed",

$ trivy convert --format template --template '{{ range . }}{{ range .Vulnerabilities }}{{ toPrettyJson . }}{{ end }}{{ end }}' report.json | grep Status | head -n 1
  "Status": 3,

$ trivy convert --format template --template '{{ range . }}{{ range .Vulnerabilities }}{{ toPrettyJson .Status }}{{ end }}{{ end }}' report.json 
3333[...]

Reproduction Steps

1. Generate a report in Trivy's default format.
2. Convert to your own format using the template.

Target

Container Image

Scanner

Vulnerability

Output Format

Template

Mode

Standalone

Debug Output

n/a

Operating System

Alpine Linux 3.15.4

Version

Version: 0.53.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-07-10 12:18:11.318231922 +0000 UTC
  NextUpdate: 2024-07-10 18:18:11.3182311 +0000 UTC
  DownloadedAt: 2024-07-10 14:26:07.383736223 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-07-10 01:04:15.811092975 +0000 UTC
  NextUpdate: 2024-07-13 01:04:15.811092815 +0000 UTC
  DownloadedAt: 2024-07-10 14:26:25.901306874 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

@afdesk Can you please take a look?

[afdesk]

yes, sure.

[afdesk]

@piotrminkina thanks for the report!
I can reproduce this case. and created a new issue - #7464