feat(dart): add graph support

[DmitriyLewen]

Description

Cache dir contains pubspec.yaml for each dependency.
We can parse these files and use them to build dependency graph.

example of work:

➜ PUB_CACHE=/Users/work/work/temp/5366/app/cache ./trivy -d fs --dependency-tree ./pubspec.lock   
...
2023-10-16T13:24:43.488+0600	INFO	Number of language-specific files: 1
2023-10-16T13:24:43.488+0600	INFO	Detecting pub vulnerabilities...
2023-10-16T13:24:43.488+0600	DEBUG	Detecting library vulnerabilities, type: pub, path: pubspec.lock

pubspec.lock (pub)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                          Title                           │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ dio     │ CVE-2021-31402 │ HIGH     │ fixed  │ 4.0.6             │ 5.0.0         │ dio vulnerable to CRLF injection with HTTP method string │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2021-31402               │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘

Dependency Origin Tree (Reversed)
=================================
pubspec.lock
└── dio@4.0.6, (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
    └── retrofit@2.0.0

TODO for another PR:

• add support of Package.Dev flag (to exclude dev deps)
• add parsing of LICENSE files (we can check LICENSE file next to pubspec.yaml and find licenses)
• ??? use : separator for ID - https://dart.dev/tools/pub/cmd/pub-add#version-constraint

Related issues

• Close feat(dart): add dependency tree support #5366

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

Can't we use fsutils.WalkDir?

[DmitriyLewen]

This is same case as with go.mod licenses -

trivy/pkg/fanal/analyzer/language/golang/mod/mod.go

Line 265 in 6040d9f

err := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {

Some example:
User uses default cache path (~/.pub_cache).
But he scans project dir (e.g. ~/project1).
In this case we don't add pubspec.yaml files from ~/.pub_cache in FS for PostAnalyze.
=> we can't read these files from input.FS.
Correct me, if i missed something.

Perhaps we can use os.DirFS("/") (fsutils.WalkDir(os.DirFS("/"), ".", required, func(path string, d fs.DirEntry, r io.Reader) error ). But i am not sure that it make sense.

[knqyf263]

Doesn't os.DirFS(dir) work?

[DmitriyLewen]

After my suggestion about os.DirFS I didn't think of an obvious solution 😄 .
Thank you!
I used fsutils.WalkDir in 3abdc47