bug(misconf): Hang on recursive terraform module

[simar7]

Discussed in #5086

^{Originally posted by sebastianblunt September 1, 2023}

Description

trivy seems to hang on recursive terraform modules, even exceeding --timeout.

It also seems to happen if you have a module that references a child module such that the reference to the child module is the same as the path to the outer module relative to where trivy is run from AND the inner child module is missing. This can be reproduced with reproduction steps (2).

Desired Behavior

trivy to exit.

Actual Behavior

trivy hangs indefinitely.

Reproduction Steps

(1) Create file with contents

module "foo" {
  source = "."
}

Run trivy config .

OR

(2) A file named foo/foo.tf with contents

module "foo" {
  source = "./foo"
}

and no other files. Run trivy config . from the outer directory.

### Target

Filesystem

### Scanner

None

### Output Format

None

### Mode

None

### Debug Output

```bash
> trivy config . --debug
2023-09-01T17:06:54.901+0900	DEBUG	Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-09-01T17:06:54.901+0900	DEBUG	cache dir:  /home/sb/.cache/trivy
2023-09-01T17:06:54.901+0900	INFO	Misconfiguration scanning is enabled
2023-09-01T17:06:54.901+0900	DEBUG	Policies successfully loaded from disk
2023-09-01T17:06:54.926+0900	DEBUG	Walk the file tree rooted at '.' in parallel
2023-09-01T17:06:54.926+0900	DEBUG	Scanning Terraform files for misconfigurations...

Operating System

Linux

Version

Version: v0.44.1
Policy Bundle:
  Digest: sha256:fd5f1ce3d8efb1fe158cb41f9adb9d7c7cc5c4c863b261053c962e6d950350b3
  DownloadedAt: 2023-09-01 08:06:13.227805289 +0000 UTC

Checklist

• Run trivy image --reset
• Read the troubleshooting

[simar7]

Fixed via aquasecurity/defsec#1454