KSV-0109 misses literal secret when colon and equals cause an evaluation conflict

[cadugevaerd]

Description

KSV-0109 can fail to evaluate a ConfigMap when a line has both : and =. Trivy logs an evaluation error, exits zero and can miss a literal secret. Previously filed as #11544, which was closed in favor of a Discussion.

Reproduction

With Trivy v0.74.0 and the official trivy-checks v2.3.0 bundle (sha256:b591e9190cff4aa4e385b1a25bccfd9ecf178d3c77fd194e1410b7ce7e1df058), scan this entirely synthetic file:

apiVersion: v1
kind: ConfigMap
metadata:
  name: example
data:
  settings: |
    password=synthetic:123

trivy config --checks-bundle-repository mirror.gcr.io/aquasec/trivy-checks@sha256:b591e9190cff4aa4e385b1a25bccfd9ecf178d3c77fd194e1410b7ce7e1df058 --exit-code 1 --severity HIGH,CRITICAL example.yaml

Observed: eval_conflict_error: functions must not produce multiple outputs for same inputs, exit code 0, and no KSV-0109 finding. Expected: a KSV-0109 finding, nonzero exit and no evaluation error.

The v2.3.0 rule and current main use some delimiter in {":", "="} in the single-output config_map_secret_key function. Please also consider shell expressions with a literal default such as ${PASSWORD:-synthetic} and nested defaults; references with an empty default should not be reported as literal secrets.

Rule: https://github.com/aquasecurity/trivy-checks/blob/v2.3.0/checks/kubernetes/configMap_with_secrets.rego

[nikpivkin]

Hi @cadugevaerd , thanks for the report!

Track #11565