feat(secret): detect secrets removed or overwritten in upper layer

[DmitriyLewen]

Description

Secrets can be deleted or overwritten in the upper layer.
We still have to keep these secrets.

Which layer contains the secret file, you can see in the Layer field when using the json format:

...
    {
      "Target": "/usr/secret.txt",
      "Class": "secret",
      "Layer": "sha256:8193895fe615d0d77042b962ebfac2b6732bee03b0a8914650414730cb168e55",
      "Secrets": [
        {
          "RuleID": "aws-access-key-id",
          "Category": "AWS",
          "Severity": "CRITICAL",
          "Title": "AWS Access Key ID",
          "StartLine": 1,
          "EndLine": 1,
          "Code": {
            "Lines": [
              {
                "Number": 1,
                "Content": "AWS_ACCESS_KEY_ID=********************",
                "IsCause": true,
                "Annotation": "",
                "Truncated": false,
                "Highlighted": "AWS_ACCESS_KEY_ID=********************",
                "FirstCause": true,
                "LastCause": true
              },
            ]
          },
          "Match": "AWS_ACCESS_KEY_ID=********************"
        }
      ]
    },
    {
      "Target": "/usr/secret.txt",
      "Class": "secret",
      "Layer": "sha256:9b98752743e6bcc98cb1032601866d49c0b43f380eba23951eceddc39e9e748e",
      "Secrets": [
        {
          "RuleID": "github-pat",
          "Category": "GitHub",
          "Severity": "CRITICAL",
          "Title": "GitHub Personal Access Token",
          "StartLine": 1,
          "EndLine": 1,
          "Code": {
            "Lines": [
              {
                "Number": 1,
                "Content": "GITHUB_PAT=****************************************",
                "IsCause": true,
                "Annotation": "",
                "Truncated": false,
                "Highlighted": "GITHUB_PAT=****************************************",
                "FirstCause": true,
                "LastCause": true
              }
            ]
          },
          "Match": "GITHUB_PAT=****************************************"
        }
      ]
    }
  ]
}

Related issues

• Close Keep detected secrets removed in upper layer #2194

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

We should have Layer here rather than in Result.

trivy/pkg/fanal/types/secret.go

Lines 11 to 20 in 7699153

	type SecretFinding struct {
	RuleID string
	Category SecretRuleCategory
	Severity string
	Title string
	StartLine int
	EndLine int
	Code Code
	Match string
	}

If the finding is the same, the first introduced layer should be taken.

• Layer 1
  • no secret found
• Layer 2
  • secret.txt
    • GitHub PAT
• Layer 3
  • secret.txt
    • GitHub PAT
    • AWS Access Key
• Layer 4
  • remove secret.txt

The result would be as below.

{
  "Target": "secret.txt",
  "Secrets": [
    {
      "RuleID": "github-pat",
      ...
      "Layer": "Layer 2",
    },
    {
      "RuleID": "aws-access-key",
      ...
      "Layer": "Layer 3",
    }
  ]
}

We should not have github-pat in Layer 3.

[knqyf263]

Note that Layer actually consists of Digest and DiffID. The above example is for sake of simplicity.

[DmitriyLewen]

Done