panic: value is marked, so must be unmarked first

[dynek]

Description

Trivy crashes when scanning sensitive(jsondecode())

Desired Behavior

Scan and report nothing

Actual Behavior

panic: value is marked, so must be unmarked first

goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Value.assertUnmarked(...)
	/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/marks.go:141
github.com/zclconf/go-cty/cty.Value.LengthInt({{{0x6611268?, 0xc002af5940?}}, {0x4dc6000?, 0xc006d8d968?}})
	/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/value_ops.go:1148 +0x5b
github.com/aquasecurity/trivy/pkg/iac/terraform/context.isNotEmptyObject({{{0x6611268?, 0xc002af5940?}}, {0x4dc6000?, 0xc006d8d968?}})
	/home/runner/work/trivy/trivy/pkg/iac/terraform/context/context.go:145 +0x8e
github.com/aquasecurity/trivy/pkg/iac/terraform/context.mergeObjects.func1({{{0x6611310?, 0xc00037af49?}}, {0x4805dc0?, 0xc002af5d20?}}, {{{0x6611268?, 0xc002af5c30?}}, {0x4dc6000?, 0xc006d8daa0?}})
	/home/runner/work/trivy/trivy/pkg/iac/terraform/context/context.go:134 +0xf8
github.com/zclconf/go-cty/cty.Value.ForEachElement({{{0x6611268?, 0xc002af5cf0?}}, {0x4bdfea0?, 0xc003a72a80?}}, 0xc001213058)
	/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/value_ops.go:1247 +0x97
github.com/aquasecurity/trivy/pkg/iac/terraform/context.mergeObjects({{{0x6611268?, 0xc002af5a00?}}, {0x4bdfea0?, 0xc003a72210?}}, {{{0x6611268?, 0xc002af5cf0?}}, {0x4bdfea0?, 0xc003a72a80?}})
	/home/runner/work/trivy/trivy/pkg/iac/terraform/context/context.go:131 +0x250
github.com/aquasecurity/trivy/pkg/iac/terraform/context.mergeVars({{{0x6611268?, 0xc002af5a00?}}, {0x4bdfea0?, 0xc003a72210?}}, {0xc001213448?, 0xffffffffffffffff?, 0x0?}, {{{0x6611268, 0xc002af5cf0}}, {0x4bdfea0, ...}})
	/home/runner/work/trivy/trivy/pkg/iac/terraform/context/context.go:107 +0xfd
github.com/aquasecurity/trivy/pkg/iac/terraform/context.(*Context).Set(0xc002af56c0, {{{0x6611268?, 0xc002af5cf0?}}, {0x4bdfea0?, 0xc003a72a80?}}, {0xc001213448, 0x1, 0x1})
	/home/runner/work/trivy/trivy/pkg/iac/terraform/context/context.go:89 +0x105
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateStep(0xc00140d720)
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:97 +0xe5
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSteps(0xc00140d720)
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:272 +0x152
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0xc00140d720, {0x660eda8, 0xc00162c150})
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:136 +0x1e5
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*Parser).EvaluateAll(0xc003526640, {0x660eda8, 0xc00162c150})
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/parser.go:386 +0x90
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform.(*Scanner).ScanFS(0xc0029ee510, {0x660eda8, 0xc00162c150}, {0x65ad0a0, 0xc006d8d2c0}, {0x658ddc0, 0x1})
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/scanner.go:123 +0x786
github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan(0xc0069f68c0, {0x660ee50, 0xc0009a9ab0}, {0x65ad0a0, 0xc006d8d2a8})
	/home/runner/work/trivy/trivy/pkg/misconf/scanner.go:149 +0x297
github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze(0xc006e08f40, {0x660ee50?, 0xc0009a9ab0?}, {{0x65ad0a0, 0xc006d8d2a8}, {0x0, 0x0, 0x0}, {0x0, 0x0}})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/config/config.go:44 +0x45
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0xc002af4750, {0xc006582200, 0x20, 0x20}, {0xc006582400, 0x18, 0x20}, 0xc00550ac60, {0x54053ca, 0x7}}, ...)
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:519 +0x399
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x5554ffffff12, 0x1}, 0xc002af4fd0, {0x7fffb8edb100, 0xc00461fe60}, {0x65acfc0, 0x9817b60}, {0xc002af4750, {0xc006582200, 0x20, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:235 +0x809
github.com/aquasecurity/trivy/pkg/scan.Service.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0xc000bddd60, 0x2, 0x2}, {0xc001015b40, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/scan/service.go:164 +0xe7
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan(_, {_, _}, {{{0x541d106, 0xa}, 0x0, 0x1, 0x0, 0x0, 0x45d964b800, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:677 +0x377
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x541d106, 0xa}, 0x0, 0x1, 0x0, 0x0, 0x45d964b800, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:287 +0xc9
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x541d106, 0xa}, 0x0, 0x1, 0x0, 0x0, 0x45d964b800, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:232 +0xc7
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x541d106, 0xa}, 0x0, 0x1, 0x0, 0x0, 0x45d964b800, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:212 +0x211
github.com/aquasecurity/trivy/pkg/commands/artifact.run({_, _}, {{{0x541d106, 0xa}, 0x0, 0x1, 0x0, 0x0, 0x45d964b800, {0xc00014d410, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:448 +0x710
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x541d106, 0xa}, 0x0, 0x1, 0x0, 0x0, 0x45d964b800, {0xc00014d410, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:410 +0x399
github.com/aquasecurity/trivy/pkg/commands.NewFilesystemCommand.func2(0xc000f92608, {0xc0010ad680, 0x1, 0x4})
	/home/runner/work/trivy/trivy/pkg/commands/app.go:379 +0x1a5
github.com/spf13/cobra.(*Command).execute(0xc000f92608, {0xc0010ad640, 0x4, 0x4})
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1015 +0xaaa
github.com/spf13/cobra.(*Command).ExecuteC(0xc000910908)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1148 +0x46f
github.com/spf13/cobra.(*Command).Execute(...)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1071
github.com/spf13/cobra.(*Command).ExecuteContext(0x660ed70?, {0x660f160?, 0xc000ef9980?})
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1064 +0x47
main.run()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:51 +0x19f
main.main()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x1f
``

### Reproduction Steps

```bash
1. Created main.tf containing:

variable "certificate_secrets" { default = "{\"import\": \"dummy\", \"nss\": \"dummy\"}" }
locals {
  certificate_secrets = sensitive(jsondecode(var.certificate_secrets))
}

2. Run trivy -q filesystem --scanners misconfig .

### Target

Filesystem

### Scanner

Misconfiguration

### Output Format

JSON

### Mode

Standalone

### Debug Output

```bash
There's no debug output, as trivy crashes.

Operating System

Trivy container (alpine)

Version

Version: 0.65.0
Check Bundle:
  Digest: sha256:a471e90b7c7335e914ec9075b74cf8f65e4c91e6cecfa7e39c587382808d2684
  DownloadedAt: 2025-08-15 06:42:00.638092619 +0000 UTC

### Checklist

- [X] Run `trivy clean --all`
- [X] Read [the troubleshooting](https://trivy.dev/latest/docs/references/troubleshooting/)

[nikpivkin]

Hi @dynek !

Track #9343

[dynek]

Thank you, I raised a discussion by mistake, instead of an issue directly.

[simar7]

@dynek that's the right way to go about it. We first discuss to determine if an issue actually exists.

[dynek]

@nikpivkin I tried with the very same piece of code and I am still getting the same error.

Version: 0.67.0
Check Bundle:
  Digest: sha256:a471e90b7c7335e914ec9075b74cf8f65e4c91e6cecfa7e39c587382808d2684
  DownloadedAt: 2025-10-02 11:02:02.944403 +0000 UTC

[nikpivkin]

I'll take a look.

[dynek]

Nothing regarding this went through in the two last releases, but tried it nevertheless.
Same with 0.67.1 and 0.67.2.