[BUG] Archive scan results polluted by previous scanners

[yanover]

Describe the bug

When analyzing a .tar archive that contains multiple files (e.g. ELF binary, JSON, text), the results from the ScanSave scanner (such as the compressed/encoded content of the ELF file) are attached in the "scan": { "save": ... } section of every extracted file's output, regardless of whether that file was actually processed by ScanSave.

Only the ELF file has "scanners": ["ScanSave"], but "scan": { "save": ... } appears for JSON and TXT as well.

This results in duplicate and incorrect scan results being shown for files that should not be scanned by ScanSave.

Is that a intended behavior ? I did not find anything in the documentation that detail this behavior.

Environment details

• k8s

Steps to reproduce
Steps to reproduce the behavior:

1. Prepare a tar file with at least three files: one ELF binary, one JSON file, and one text file
2. Configure Strelka backend with the following scanner configuration:

scanners:
  'ScanTar':
    - positive:
        flavors:
          - 'application/x-tar'
          - 'tar_file'
      priority: 5
  'ScanSave':
    - positive:
        flavors:
          - 'elf_file'
      priority: 5
      options:
        compression: 'gzip'
        encoding: 'base64'

3. Submit the tar file for analysis
4. View the JSON output/results for each extracted file

Expected behavior
Only the ELF file extracted from the tar archive should have "scanners": ["ScanSave"] and a "scan": { "save": ... } block containing the encoded ELF content.

Files that do not match the positive flavor criteria (e.g. JSON with json_file flavor, TXT with text/plain MIME type) should:

• Not have ScanSave in their "scanners" array
• Not have any "scan": { "save": ... } result

Release

• Release: v1.0.0

Additional context

If the archive contains another file that match the scanSave flavor, the "file" key is correctly populated.

// File 0: archive
{
  "file": {
    "name": "archive.tar",
    "flavors": { "yara": ["tar_file"], "mime": ["application/x-tar"] },
    "scanners": ["ScanTar"]
  },
}
// File 1: busybox (ELF) - CORRECT
{
  "file": {
    "name": "busybox",
    "flavors": { "yara": ["elf_file"], "mime": ["application/x-sharedlib"] },
    "source": "ScanTar",
    "scanners": ["ScanSave"]
  },
  "scan": { "save": { "compression": "gzip", "elapsed": 0.088491, "encoding": "base64" } }
}

// File 2: data.json - INCORRECT (should NOT have save results)
{
  "file": {
    "name": "data.json",
    "source": "ScanTar",
    "flavors": { "yara": ["json_file"], "mime": ["application/json"] },
    "scanners": []
  },
  "scan": { "save": { "compression": "gzip", "elapsed": 0.088491, "encoding": "base64" } }
}