Package query fails on debian based container

[leg100]

Environment

Kubernetes/Docker/Debian

I'm running vuls in a container, scanning another container, on a kubernetes cluster.

Config:

[servers]

[servers.localhost]
host = "localhost"
port = "local"

[servers.localhost.containers]
includes = ["target"]

Where target is the name of the container I'm scanning. It is a debian (wheezy) based container.

Vuls

Hash : 8e15b9c

OS

• Target Server: debian container
• Vuls Server: debian container

Go

• Go version: 1.8

Current Output

[Oct 20 08:03:41] DEBUG [af93ae03c129@localhost] execResult: servername: 
  cmd: docker exec --user 0 af93ae03c129 /bin/bash -c "dpkg-query -W -f='${binary:Package},${db:Status-Abbrev},${Version}\n'"
  exitstatus: 0
  stdout: ,,,,
,,,,
,,,,
,,,,
,,,,
,,,,
,,,,
,,,,
<snip>
,,,,
,,,,
,,,,
,,,,
,,,,
,,,,

  stderr: 
  err: %!s(<nil>)
[Oct 20 08:03:41] DEBUG [localhost] Panic: runtime error: index out of range on af93ae03c129@localhost

Addition Details

Expected Behavior

List packages in debug logs, and produce a report.

Actual Behavior

Panic

Steps to reproduce the behaviour

vuls scan -containers-only -debug -config config.toml

[leg100]

I believe the cause is that bash is performing parameter expansion on dpkg-query's $ variables, and we don't want that. It does this because when single quotes are enclosed in double quotes, they lose their special behaviour of turning off parameter expansion. For example:

echo "'${foo}'"

returns an empty string, rather than ${foo}.

The fix would be to backslash the dollars. This would fix this particular case with bash and double quotes, but it might break other cases where bash and double quotes aren't used? Is this particular to docker exec?

[nashiox]

I was troubled with the same problem.
I tried PR(#522), is it the same recognition?