fix image vulnerability scan

Makefile

@@ -30,9 +30,9 @@ console_plugins: secretscanner malwarescanner packagescanner
 
 .PHONY: bootstrap-agent-plugins
 bootstrap-agent-plugins:
-	cd $(DEEPFENCE_AGENT_DIR)/plugins && bash bootstrap.sh && cd -
-	cd $(SECRET_SCANNER_DIR) && bash bootstrap.sh && cd -
-	cd $(MALWARE_SCANNER_DIR) && bash bootstrap.sh && cd -
+	(cd $(DEEPFENCE_AGENT_DIR)/plugins && bash bootstrap.sh)
+	(cd $(SECRET_SCANNER_DIR) && bash bootstrap.sh)
+	(cd $(MALWARE_SCANNER_DIR) && bash bootstrap.sh)
 
 .PHONY: agent
 agent:

deepfence_agent/tools/apache/scope/probe/host/generate_sbom.go

@@ -55,10 +55,10 @@ func GenerateSbomForVulnerabilityScan(nodeType, imageName, imageId, scanId, cont
 	if nodeType == "host" {
 		source = scanPath
 	} else if nodeType == "container_image" {
-		if imageId != "" {
-			source = imageId
-		} else {
+		if imageName != "" {
 			source = imageName
+		} else {
+			source = imageId
 		}
 	} else if nodeType == "container" {
 		if containerId != "" {
@@ -107,22 +107,24 @@ func StartVulnerabilityScan(req ctl.StartVulnerabilityScanRequest) error {
 		node_id = node_id_Arg
 	}
 
+	if image_name_Arg, ok := req.BinArgs["image_name"]; ok {
+		imageName = image_name_Arg
+	}
+
 	switch node_type {
 	case "container":
 		containerId = node_id
-		containerName = node_id
 	case "image":
 		imageId = node_id
-		imageName = node_id
 		node_type = "container_image"
 	}
 
 	if kubernetesClusterNameArg, ok := req.BinArgs["kubernetes_cluster_name"]; ok {
 		kubernetesClusterName = kubernetesClusterNameArg
 	}
 	if (node_type == "container" && containerId == "") ||
-		(node_type == "container_image" && imageId == "") {
-		return errors.New("image_id/container_id is required for container/image vulnerability scan")
+		(node_type == "container_image" && (imageId == "" || imageName == "")) {
+		return errors.New("image_id/image_name/container_id is required for container/image vulnerability scan")
 	}
 	if scanTypeArg, ok := req.BinArgs["scan_type"]; ok {
 		scanType = scanTypeArg

deepfence_server/handler/scan_reports.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -21,13 +22,52 @@ import (
 	httpext "github.com/go-playground/pkg/v5/net/http"
 	"github.com/gorilla/schema"
 	"github.com/minio/minio-go/v7"
+	"github.com/neo4j/neo4j-go-driver/v4/neo4j"
 	"github.com/twmb/franz-go/pkg/kgo"
 )
 
 func scanId(req model.ScanTriggerReq) string {
 	return fmt.Sprintf("%s-%d", req.NodeId, time.Now().Unix())
 }
 
+func GetImageFromId(ctx context.Context, node_id string) (string, string, error) {
+	var name string
+	var tag string
+
+	driver, err := directory.Neo4jClient(ctx)
+	if err != nil {
+		return name, tag, err
+	}
+
+	session := driver.NewSession(neo4j.SessionConfig{AccessMode: neo4j.AccessModeRead})
+	if err != nil {
+		return name, tag, err
+	}
+	defer session.Close()
+
+	tx, err := session.BeginTransaction()
+	if err != nil {
+		return name, tag, err
+	}
+	defer tx.Close()
+
+	query := "MATCH (n:ContainerImage{node_id:$node_id}) return  n.docker_image_name,n.docker_image_tag"
+	res, err := tx.Run(query, map[string]interface{}{"node_id": node_id})
+	if err != nil {
+		return name, tag, err
+	}
+
+	rec, err := res.Single()
+	if err != nil {
+		return name, tag, err
+	}
+
+	name = rec.Values[0].(string)
+	tag = rec.Values[1].(string)
+
+	return name, tag, nil
+}
+
 func (h *Handler) StartVulnerabilityScanHandler(w http.ResponseWriter, r *http.Request) {
 	req, err := extractScanTrigger(w, r)
 	if err != nil {
@@ -42,9 +82,22 @@ func (h *Handler) StartVulnerabilityScanHandler(w http.ResponseWriter, r *http.R
 		"node_id":   req.NodeId,
 	}
 
+	nodeTypeInternal := ctl.StringToResourceType(req.NodeType)
+
+	if nodeTypeInternal == ctl.Image {
+		name, tag, err := GetImageFromId(r.Context(), req.NodeId)
+		if err != nil {
+			log.Error().Msg(err.Error())
+			httpext.JSON(w, http.StatusInternalServerError, model.Response{Success: false})
+			return
+		}
+		binArgs["image_name"] = name + ":" + tag
+		log.Info().Msgf("node_id=%s image_name=%s", req.NodeId, binArgs["image_name"])
+	}
+
 	internal_req := ctl.StartSecretScanRequest{
 		NodeId:   req.NodeId,
-		NodeType: ctl.StringToResourceType(req.NodeType),
+		NodeType: nodeTypeInternal,
 		BinArgs:  binArgs,
 	}