fix(report): check the URI before converting it to a string

[Eljees]

Description

toUri logs the error and returns nil when url.Parse rejects its input, but addSarifResult dereferenced that pointer without a check, so writing a SARIF report panicked. url.Parse rejects any path that contains a bare % (100%.tf -> invalid URL escape "%.t"), so scanning a repository that happens to contain such a file crashes --format sarif.

The sibling field data.url was already guarded a few lines above (sarif.go:91); this routes both conversions through a small uriString helper so the two are handled the same way. Behaviour for parsable URIs is unchanged.

Both call sites of addSarifResult were affected, the vulnerability branch (sarif.go:160) and the misconfiguration branch (sarif.go:184); the added test covers both.

Before

100%.tf containing an aws_s3_bucket resource, then trivy fs --scanners misconfig --format sarif .:

INFO  [terraform scanner] Scanning root module  file_path="."
ERROR [sarif] Unable to parse URI  URI="100%.tf" err="parse \"100%.tf\": invalid URL escape \"%.t\""
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x2debf6c]

goroutine 1 [running]:
net/url.(*URL).String(...)
	/usr/local/go/src/net/url/url.go:800 +0x2c
github.com/aquasecurity/trivy/pkg/report.(*SarifWriter).addSarifResult(...)
	pkg/report/sarif.go:103 +0x305
github.com/aquasecurity/trivy/pkg/report.(*SarifWriter).Write(...)
	pkg/report/sarif.go:184 +0x11ce
github.com/aquasecurity/trivy/pkg/report.Write(...)
	pkg/report/writer.go:111 +0xbeb
...
exit status 2

After

Same command, exit code 0, valid SARIF:

"locations": [
  {
    "physicalLocation": {
      "artifactLocation": {
        "uri": "",
        "uriBaseId": "ROOTPATH"
      },
      "region": {
        "startLine": 1,
        "startColumn": 1,
        "endLine": 3,
        "endColumn": 1
      }
    },
    "message": {
      "text": "100%.tf"
    }
  }
]

One point I would like your opinion on: an unparsable path now produces an empty artifactLocation.uri, and the raw path survives only in the location message. The alternative is to fall back to an escaped path (&url.URL{Path: str}, which renders 100%.tf as 100%25.tf) so the location is preserved. I kept the minimal change because the issue describes "log this and return nil" as the intended contract, but I am happy to switch to the fallback if you prefer it.

Related issues

• Close fix(sarif): check url before converting to string #8154

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).