Trivy Web UI

## Trivy Web UI - Container Image Security Scanning Tool A container image security scanning tool based on Aqua Security Trivy, providing a clean Web UI interface for vulnerability scanning, configuration checking, and SBOM generation. ## Key Features - 🔍 **Vulnerability Scanning**: Detect known vulnerabilities (CVE) in OS packages and application dependencies - ⚙️ **Configuration Checking**: Detect IaC (Infrastructure as Code) configuration errors - 🔐 **Secret Scanning**: Discover sensitive information leakage in code - 📋 **SBOM Generation**: Generate Software Bill of Materials (CycloneDX, SPDX formats) - 📊 **Real-time Logs**: Push real-time scan logs via SSE - 📦 **Multi-format Reports**: Support JSON, SARIF, Table and more formats - 💾 **Configuration Management**: Save and manage frequently-used scan configurations - 🔒 **OIDC Authentication**: Unified authentication support, user configuration isolation - 📜 **Scan History**: Keep complete scan history, support result comparison and trend analysis - 🎯 **Task Queue**: Serial execution of scan tasks, ensure system stability ## Usage Instructions 1. **Fill in Image Address** (e.g., `docker.io/library/nginx:latest`) - For private registries, provide username and password - Choose whether to verify TLS certificates (verified by default) 2. **Configure Scan Options** (optional) - **Vulnerability Severity**: Select vulnerability levels to display (CRITICAL/HIGH/MEDIUM/LOW/UNKNOWN) - **Scanner Types**: Select scan types (vuln/misconfig/secret/license) - **Detection Priority**: Precise mode (reduce false positives) or Comprehensive mode (more detection) - **Package Types**: Scan only OS packages or application dependencies - **Output Format**: JSON/Table/SARIF/CycloneDX/SPDX 3. **Click "Start Scan" Button** - View scan progress and logs in real-time - View vulnerability statistics and detailed list after completion - Download scan reports in various formats ## Configuration Save Feature - Save frequently-used configurations via **Configuration Management Panel** - Multi-configuration management support, max 4KB per config - Maximum 1000 configs per user - With OIDC authentication enabled, configs are automatically isolated per user - **Password Save Control**: Passwords not saved by default (maximum security), can be enabled via configuration ## Scan History Management - View all scan history records (sorted by time descending) - Filter by status (all/success/failed/running) - Search by image name - Filter by time range - View vulnerability statistics and detailed list - Download scan reports in various formats ## Security Features ### Protection Mechanisms - ✅ **Command Injection Protection**: No shell execution, fundamentally prevents command injection - ✅ **Input Validation**: All user inputs strictly validated with whitelist - ✅ **Parameter Injection Protection**: Rejects inputs containing shell metacharacters - ✅ **DoS Protection**: Input length limits prevent memory exhaustion attacks ### Credential Security - ✅ **Passwords Not Saved by Default**: Config save feature disables password storage by default - ✅ **Automatic Log Sanitization**: All credential information in logs automatically replaced with `***` - ✅ **HTTPS Transmission**: Production environment credentials transmitted via HTTPS POST - ✅ **Temporary Memory Storage**: Credentials only used temporarily during Trivy execution ### User Isolation - ✅ **OIDC Unified Authentication**: Integrated with Lazycat Cloud authentication system - ✅ **Configuration Isolation**: Each user's configurations stored in separate directories - ✅ **Session Management**: HttpOnly Cookie, 7-day validity, automatic expiration cleanup - ✅ **Access Control**: All scan APIs require authentication, unauthenticated access redirects to login ### Resource Limits - ✅ **Config Size Limit**: Maximum 4KB per config, prevents storage space abuse - ✅ **Config Count Limit**: Maximum 1000 configs per user, prevents DoS attacks - ✅ **Timeout Control**: Default 10-minute timeout, prevents infinite task execution - ✅ **Serial Execution**: Task queue mechanism, only one scan task runs at a time, keeps system stable