Preview allows fetching modules from various sources, including remote resources. There is an OptionWithDownloads(false) that prevents this. An even better solution would include passing in an http.Client that prevents transport.
https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/terraform/parser/module_retrieval.go#L19-L20
Or some test should exist to verify this behavior.
This should be completed before early-access. We will add a Trivy-specific ticket to track our upstream changes after we fix this in our fork.
Preview allows fetching modules from various sources, including remote resources. There is an
OptionWithDownloads(false)that prevents this. An even better solution would include passing in anhttp.Clientthat prevents transport.https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/terraform/parser/module_retrieval.go#L19-L20
Or some test should exist to verify this behavior.
This should be completed before early-access. We will add a Trivy-specific ticket to track our upstream changes after we fix this in our fork.