Trivy fails to parse composer.lock containing UTF-8 encoded characters

[buffcode]

Description

Trivy fails to parse composer.lock containing UTF-8 encoded characters

Desired Behavior

Correctly parse composer.json/.lock when encoded characters are used.

Actual Behavior

Parsing fails with

DEBUG   Walk error      file_path="composer.lock" err="parse error: failed to parse composer.lock: decode error: error at line 17, column 33: invalid unicode character 'invalid syntax'"

Reproduction Steps

1. Create dummy `composer.lock` file:

{
  "_readme": [
    "This file locks the dependencies of your project to a known state",
    "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
    "This file is @generated automatically"
  ],
  "content-hash": "0b8b985db91030cc794786460ebdb3f3",
  "packages": [
    {
      "name": "foo/bar",
      "version": "v1.0.0",
      "require": {
      },
      "license": [
        "proprietary"
      ],
      "description": "Erg\u0000nzung",
      "time": "2022-09-08T10:25:50+00:00"
    }
  ],
  "aliases": [],
  "minimum-stability": "dev",
  "prefer-stable": true,
  "prefer-lowest": false,
  "plugin-api-version": "2.2.0"
}


2. Run `docker run --rm -v $PWD:/myapp aquasec/trivy fs -f cyclonedx -o /myapp/result.json /myapp/composer.lock -d`

3. No components/dependencies are written to `result.json`

Target

Filesystem

Scanner

None

Output Format

CycloneDX

Mode

Standalone

Debug Output

2025-01-12T19:51:03Z    DEBUG   No plugins loaded
2025-01-12T19:51:03Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-01-12T19:51:03Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2025-01-12T19:51:03Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2025-01-12T19:51:03Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-01-12T19:51:03Z    DEBUG   Ignore statuses statuses=[]
2025-01-12T19:51:03Z    INFO    "--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the "cyclonedx" report.
2025-01-12T19:51:03Z    DEBUG   [pkg] Package types     types=[os library]
2025-01-12T19:51:03Z    DEBUG   [pkg] Package relationships     relationships=[unknown root workspace direct indirect]
2025-01-12T19:51:03Z    DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-01-12T19:51:03Z    DEBUG   Initializing scan cache...      type="memory"
2025-01-12T19:51:03Z    DEBUG   Walk error      file_path="composer.lock" err="parse error: failed to parse composer.lock: decode error: error at line 17, column 33: invalid unicode character 'invalid syntax'"
2025-01-12T19:51:03Z    DEBUG   OS is not detected.
2025-01-12T19:51:03Z    DEBUG   Detected OS: unknown
2025-01-12T19:51:03Z    INFO    Number of language-specific files       num=0
2025-01-12T19:51:03Z    DEBUG   Specified ignore file does not exist    file=".trivyignore"
2025-01-12T19:51:03Z    DEBUG   [vex] VEX filtering is disabled

Operating System

Ubuntu

Version

Version: 0.58.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @buffcode
Thanks for your report!

Created #8233