fix(java): ignore credentials and host case when matching Maven mirrors

Trivy embeds the credentials of a matching <server> into the repository URL, and `mirrorKey` derived the lookup key from the whole URL, so a mirrored repository with credentials never matched its configured entry — silently.
The key is now built from the parts that identify a repository: the credentials are dropped and the host is lower-cased, as RFC 3986 defines it as case-insensitive, while the case-sensitive path is kept.
`scan.maven.mirrors` rejects entries that differ only by those, since they collapse into a single key.

Author: DmitriyLewen

docs/guide/references/troubleshooting.md

@@ -136,6 +136,9 @@ The block applies to *all* subsequent requests from the affected IP for the dura
 Recommended mitigations:
 
 - **Populate `~/.m2` before scanning.** Run `mvn dependency:resolve` (or any build step that resolves dependencies) so that every POM is cached locally. In CI, cache the `~/.m2` directory between runs (e.g. keyed on `pom.xml` checksums) so subsequent runs reuse the artifacts.
+- **Configure mirrors** of the rate-limited repository, so that POM lookups go to a host that isn't blocking you. There are two ways to do it:
+    - `<mirrors>` in Maven's [settings.xml][maven-mirror-settings] — the standard mechanism, honored by `mvn` itself as well. A repository is served by a single mirror, so a mirror that is rate-limited too leaves nothing to fall back on.
+    - [scan.maven.mirrors][maven-mirrors] in `trivy.yaml` — Trivy-specific, and takes an ordered list of mirrors per repository. A mirror that returns `429` is skipped in favor of the next one, and the scan fails only once every mirror of an artifact is rate-limited.
 - **Wait for the block to expire.** The `Retry-After` value in the error tells you the minimum wait. Repeated scans during the block will extend it.
 - **Use `--offline-scan`** to skip remote lookups entirely and rely only on the local `~/.m2` cache. Be careful: any transitive POM missing from the cache is silently skipped, so populate `~/.m2` first (see above) — otherwise the dependency tree will be incomplete.
 
@@ -351,5 +354,7 @@ $ trivy clean --all
 ```
 
 [air-gapped]: ../advanced/air-gap.md
+[maven-mirror-settings]: https://maven.apache.org/guides/mini/guide-mirror-settings.html
+[maven-mirrors]: ../coverage/language/java.md#config-file-mirrors
 [network]: ../advanced/air-gap.md#connectivity-requirements
 [redis-cache]: ../configuration/cache.md#redis

pkg/dependency/parser/java/pom/mirror.go

@@ -102,10 +102,18 @@ func resolveMirrors(settingsMirrors []Mirror, servers []Server, configFileMirror
 	return resolved
 }
 
-// mirrorKey normalizes a repository URL to the key used for config-file mirror
-// lookup: its string form with any trailing slash trimmed, so that
-// "https://host/maven2/" and "https://host/maven2" resolve to the same key.
+// mirrorKey normalizes a repository URL to the key used for config-file mirror lookup:
+// its string form with any trailing slash trimmed, so that "https://host/maven2/" and
+// "https://host/maven2" resolve to the same key.
+//
+// The key has to identify the repository, so the parts that don't are dropped as well:
+// the credentials that Trivy embeds from a <server> — otherwise a mirrored repository
+// with credentials would never match its configured key — and the case of the host,
+// which RFC 3986 defines as case-insensitive. The path is kept as it is, being
+// case-sensitive.
 func mirrorKey(u url.URL) string {
+	u.User = nil
+	u.Host = strings.ToLower(u.Host)
 	return strings.TrimRight(u.String(), "/")
 }
 

pkg/dependency/parser/java/pom/mirror_test.go

@@ -348,6 +348,7 @@ func TestParser_mirrorFor(t *testing.T) {
 	tests := []struct {
 		name            string
 		settingsMirrors []Mirror
+		servers         []Server
 		configMirrors   map[string][]string
 		repo            repository
 		want            []repository
@@ -482,6 +483,45 @@ func TestParser_mirrorFor(t *testing.T) {
 				},
 			},
 		},
+		{
+			// Trivy embeds <server> credentials into the repository URL, so the lookup
+			// must ignore them — the configured key never carries a password.
+			name: "config file: repository credentials are ignored by the lookup",
+			configMirrors: map[string][]string{
+				"https://repo1.example.com/maven2": {"https://repo3.example.com/maven2"},
+			},
+			repo: repository{
+				id:             "corp",
+				url:            mustParseURL(t, "https://repo-user:repo-pass@repo1.example.com/maven2"),
+				releaseEnabled: true,
+			},
+			want: []repository{
+				{
+					id:             "corp",
+					url:            mustParseURL(t, "https://repo3.example.com/maven2"),
+					releaseEnabled: true,
+				},
+			},
+		},
+		{
+			// RFC 3986 defines the host as case-insensitive, unlike the path.
+			name: "config file: host case is ignored by the lookup",
+			configMirrors: map[string][]string{
+				"https://Repo1.Example.COM/maven2": {"https://repo3.example.com/maven2"},
+			},
+			repo: repository{
+				id:             "central",
+				url:            mustParseURL(t, "https://repo1.example.com/maven2"),
+				releaseEnabled: true,
+			},
+			want: []repository{
+				{
+					id:             "central",
+					url:            mustParseURL(t, "https://repo3.example.com/maven2"),
+					releaseEnabled: true,
+				},
+			},
+		},
 		{
 			// Several mirrors for one repository become ordered fallback candidates.
 			name: "config file: fallback list — repo1 -> [repo3, repo4] in order",
@@ -555,11 +595,38 @@ func TestParser_mirrorFor(t *testing.T) {
 				},
 			},
 		},
+		{
+			// Chaining through a mirror that has <server> credentials: pass 1 rewrites the
+			// repository to the mirror URL with the credentials embedded, so the config-file
+			// lookup in pass 2 sees them and must still match the plain configured key.
+			name: "cross-source: chaining through a mirror with credentials",
+			settingsMirrors: []Mirror{
+				{ID: "settings-mirror", MirrorOf: "central", URL: "https://repo2.example.com/maven2"},
+			},
+			servers: []Server{
+				{ID: "settings-mirror", Username: "mirror-user", Password: "mirror-pass"},
+			},
+			configMirrors: map[string][]string{
+				"https://repo2.example.com/maven2": {"https://repo3.example.com/maven2"},
+			},
+			repo: repository{
+				id:             "central",
+				url:            mustParseURL(t, "https://repo1.example.com/maven2"),
+				releaseEnabled: true,
+			},
+			want: []repository{
+				{
+					id:             "settings-mirror",
+					url:            mustParseURL(t, "https://repo3.example.com/maven2"),
+					releaseEnabled: true,
+				},
+			},
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			p := &Parser{mirrors: resolveMirrors(tt.settingsMirrors, nil, tt.configMirrors)}
+			p := &Parser{mirrors: resolveMirrors(tt.settingsMirrors, tt.servers, tt.configMirrors)}
 			require.Equal(t, tt.want, p.mirrorFor(tt.repo))
 		})
 	}

pkg/flag/scan_flags.go

@@ -305,9 +305,12 @@ func parseMavenMirrors(mirrors []MavenMirror) (map[string][]string, error) {
 				return nil, xerrors.Errorf("invalid Maven mirror URL in 'scan.maven.mirrors' for %s", src.Redacted())
 			}
 		}
-		// Repositories are matched ignoring the trailing slash, so entries that differ only by
-		// it are duplicates and would otherwise silently overwrite each other.
-		key := strings.TrimRight(mirror.Source, "/")
+		// The parser looks a repository up by the same key: without credentials, with a
+		// lower-cased host and without the trailing slash. Entries differing only by those
+		// collapse into one key there, so they are duplicates and are rejected here.
+		src.User = nil
+		src.Host = strings.ToLower(src.Host)
+		key := strings.TrimRight(src.String(), "/")
 		if _, ok := parsed[key]; ok {
 			return nil, xerrors.Errorf("duplicate Maven repository in 'scan.maven.mirrors': %s", src.Redacted())
 		}

pkg/flag/scan_flags_test.go

@@ -220,6 +220,41 @@ func TestScanFlagGroup_ToOptions(t *testing.T) {
 			},
 			assertion: require.Error,
 		},
+		{
+			// The parser matches repositories without their credentials, so these two
+			// would collapse into a single entry.
+			name: "maven repositories differing only by credentials are rejected",
+			fields: fields{
+				mavenMirrors: []flag.MavenMirror{
+					{
+						Source:  "https://first:pass@nexus.example.com/maven2/",
+						Targets: []string{"https://my-internal-mirror/maven2/"},
+					},
+					{
+						Source:  "https://second:pass@nexus.example.com/maven2/",
+						Targets: []string{"https://backup-mirror/maven2/"},
+					},
+				},
+			},
+			assertion: require.Error,
+		},
+		{
+			// The host is case-insensitive, so these two would collapse as well.
+			name: "maven repositories differing only by host case are rejected",
+			fields: fields{
+				mavenMirrors: []flag.MavenMirror{
+					{
+						Source:  "https://nexus.example.com/maven2/",
+						Targets: []string{"https://my-internal-mirror/maven2/"},
+					},
+					{
+						Source:  "https://Nexus.Example.COM/maven2/",
+						Targets: []string{"https://backup-mirror/maven2/"},
+					},
+				},
+			},
+			assertion: require.Error,
+		},
 	}
 
 	for _, tt := range tests {