fix(trivy): prevent import crash on legacy reports with missing Class field#15006
Open
stevewallone wants to merge 1 commit into
Open
fix(trivy): prevent import crash on legacy reports with missing Class field#15006stevewallone wants to merge 1 commit into
stevewallone wants to merge 1 commit into
Conversation
Trivy legacy-format reports have no "Class" field, so the parser set unsaved_tags entries to None (e.g. ['debian', None]). clean_tags then crashed the whole import with TypeError in TAG_PATTERN.sub, after parsing had already succeeded (regression from DefectDojo#14111 in 2.55.0). - clean_tags: drop None entries instead of crashing (defends every parser) - trivy parser: filter falsy values at all four unsaved_tags sites - regression tests: clean_tags None handling; legacy fixture tags contain no None Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
valentijnscholten
approved these changes
Jun 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes #15005. Importing a legacy-format Trivy report that has no
Classfield crashes the import pipeline after parsing succeeds, withTypeError: expected string or bytes-like object, got 'NoneType'inclean_tags. The parser setunsaved_tagsentries toNone(e.g.['debian', None]);clean_tagsthen ranTAG_PATTERN.sub("_", None)and raised, aborting the whole import.Two-part fix:
dojo/validators.py—clean_tagsnow dropsNoneentries instead of crashing. This defends the pipeline against any parser that emits aNonetag, not just Trivy.dojo/tools/trivy/parser.py— all fourunsaved_tagsassignments now filter out falsy values at the source, so legacy reports keep their real tag (debian) and simply omit the missingClass.Test results
Extended the suite (both run green):
unittests/test_validators.py(new) —clean_tagswithNoneentries, mixed, all-None, plus existing string/list/empty/invalid-type behavior.unittests/tools/test_trivy_parser.py— asserts the legacy fixture's findings contain noNonetags.Verified end-to-end on a live 2.59.0 instance: before the fix the import returns HTTP 500 (and leaks 1 partial finding); after, HTTP 201 with all 93 findings (0 Critical / 18 High / 9 Medium / 65 Low / 1 Info), each tagged
debian.Documentation
None needed — bug fix, no behavior/config/model surface change.
Checklist
dev.dev(a bug fix; CONTRIBUTING.md permits dev or bugfix).ruff.toml).bugfix— I can't set labels as an external contributor; please apply on triage.Targeted
devper CONTRIBUTING.md; happy to retarget tobugfixif you'd prefer it in a patch release.