fix(sbom): check Type when filling pkgs in vulns

[DmitriyLewen]

Description

If cyclonedx file doesn't have Components.Property.Filepath field and has 2(or more) language packages - Trivy skips 1 language package.
See #3492
This happens because pkgs have same Filepath(Target):

trivy/pkg/scanner/local/scan.go

Lines 201 to 217 in 8e7fb7c

	func (s Scanner) fillPkgsInVulns(pkgResults, vulnResults types.Results) types.Results {
	var results types.Results
	if len(pkgResults) == 0 { // '--list-all-pkgs' == false or packages not found
	return vulnResults
	}
	for _, result := range pkgResults {
	if r, found := lo.Find(vulnResults, func(r types.Result) bool {
	return r.Class == result.Class && r.Target == result.Target
	}); found {
	r.Packages = result.Packages
	results = append(results, r)
	} else { // when package result has no vulnerabilities we still need to add it to result(for 'list-all-pkgs')
	results = append(results, result)
	}
	}
	return results
	}

We need to compare pkg.Types to avoid these cases.

Related issues

• Close Duplicate entries in the affects field of vulnerabilities when outputting CycloneDX #3492

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

I think Target should not be empty and that is what we should fix.

We should fill the target here somehow. But I don't want to make a list of all package types here.

trivy/pkg/scanner/langpkg/scan.go

Lines 41 to 45 in 45d5edb

	target := app.FilePath
	if t, ok := PkgTargets[app.Type]; ok && target == "" {
	// When the file path is empty, we will overwrite it with the pre-defined value.
	target = t
	}

Any ideas?

[DmitriyLewen]

We can use bom filepath + prefix/suffix.
I mean use purl like logic.
e.g. golang:path/to/sbom/file or path/to/sbom/file:golang

[knqyf263]

We should think about the target, but I don't think comparing type has any side effects. We can add this change anyway.
@DmitriyLewen Any leftovers? Or ready for review?

[DmitriyLewen]

@DmitriyLewen Any leftovers? Or ready for review?

@knqyf263 you can review this PR.