Description

This PR adds WASM module support that allows custom processes during analysis and scanning. For example, Spring4Shell module can check if the Java version and Tomcat version satisfy the requirements of CVE-2022-22965. Then, it can change the severity or remove the detected vulnerability if any one of them is not satisfied.

It has many possibilities.

• Evaluate complex conditions like Spring4Shell
• Detect a shell script communicating with malicious domains
• Detect malicious python install script (setup.py)
• Even detect misconfigurations in WordPress setting
• etc.

It supports only TinyGo for now, but plans to add support for more languages such as Rust.

Issues

• Close Trivy extensibility model #2209

Related PRs

• refactor: do not import defsec in types package fanal#537

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).