fix(scanner/lockfile): fix binary lockfile scan on windows

[MaineK00n]

If this Pull Request is work in progress, Add a prefix of “[WIP]” in the title.

What did you implement:

Fixes #2305

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

setup

PS C:\Users\vagrant> curl.exe -sL --create-dirs --output Downloads\log4j-core-2.13.0.jar https://github.com/vulsio/integration/raw/refs/heads/main/data/lockfile/log4j-core-2.13.0.jar
PS C:\Users\vagrant> curl.exe -sL --create-dirs --output Downloads/package-lock.json https://raw.githubusercontent.com/vulsio/integration/refs/heads/main/data/lockfile/npm-v3/package-lock.json

before (v0.33.4)

local scan

PS C:\Users\vagrant> @"
version = "v2"

[default]

[servers]

[servers.lockfile]
host = "localhost"
port = "local"
scanMode           = ["fast"]
scanModules        = ["lockfile"]
lockfiles = [
    "C:\\Users\\vagrant\\Downloads\\package-lock.json",
    "C:\\Users\\vagrant\\Downloads\\log4j-core-2.13.0.jar"
]
"@ | Set-Content config.toml

PS C:\Users\vagrant> cmd.exe /c 'curl.exe -sL https://github.com/future-architect/vuls/releases/download/v0.33.4/vuls_0.33.4_windows_amd64.tar.gz | tar.exe zxf - vuls.exe'
PS C:\Users\vagrant> .\vuls.exe scan
time="Sep  4 07:28:21" level=info msg="vuls-0.33.4-0993588f1129ea7013049e282122798e38ff1b4b-2025-08-27T05:24:54Z" 
...
Scan Summary
================
lockfile        windowsWindows 11 Version 24H2 for x64-based Systems    0 installed, 0 updatable        250 libs

PS C:\Users\vagrant> cat .\results\2025-09-04T07-28-49-0700\lockfile.json | Select-String -SimpleMatch '"path": "C:\\Users\\vagrant\\Downloads\\' 

            "path": "C:\\Users\\vagrant\\Downloads\\package-lock.json"

remote scan (linux -> windows:CMD)

$ cat << EOS > config.toml
version = "v2"

[default]

[servers]

[servers.lockfile]
host = "127.0.0.1"
port = "2222"
user = "vagrant"
keyPath = "/home/vuls/.ssh/id_rsa"
scanMode           = ["fast"]
scanModules        = ["lockfile"]
lockfiles = [
    "C:\\Users\\vagrant\\Downloads\\package-lock.json",
    "C:\\Users\\vagrant\\Downloads\\log4j-core-2.13.0.jar"
]
EOS

$ curl -sL https://github.com/future-architect/vuls/releases/download/v0.33.4/vuls_0.33.4_linux_amd64.tar.gz | tar zxf - vuls
$ ./vuls scan
[Sep  4 23:31:26]  INFO [localhost] vuls-0.33.4-0993588f1129ea7013049e282122798e38ff1b4b-2025-08-27T05:24:54Z
...
Scan Summary
================
lockfile	windowsWindows 11 Version 24H2 for x64-based Systems	0 installed, 0 updatable	250 libs

$ jq -r '.libraries[].path' results/2025-09-04T23-31-42+0900/lockfile.json
C:\Users\vagrant\Downloads\package-lock.json

after

local scan (CMD)

vagrant@DESKTOP C:\Users\vagrant> echo version = "v2" > config.toml
vagrant@DESKTOP C:\Users\vagrant> echo. >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo [default] >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo. >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo [servers] >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo. >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo [servers.lockfile] >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo host = "localhost" >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo port = "local" >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo scanMode           = ["fast"] >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo scanModules        = ["lockfile"] >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo lockfiles = [ >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo     "C:\Users\vagrant\Downloads\package-lock.json", >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo     "C:\Users\vagrant\Downloads\log4j-core-2.13.0.jar" >> config.toml
vagrant@DESKTOP C:\Users\vagrant> echo ] >> config.toml

vagrant@DESKTOP C:\Users\vagrant> .\vuls.exe scan
...
Scan Summary
================
lockfile        windowsWindows 11 Version 24H2 for x64-based Systems    0 installed, 0 updatable        251 libs

vagrant@DESKTOP C:\Users\vagrant> findstr "\"path\": \"C:\\Users\\vagrant\\Downloads\\" .\results\2025-09-04T07-39-30-0700\lockfile.json
            "path": "C:\\Users\\vagrant\\Downloads\\package-lock.json"
            "path": "C:\\Users\\vagrant\\Downloads\\log4j-core-2.13.0.jar"

local scan (powershell)

PS C:\Users\vagrant> @"
version = "v2"

[default]

[servers]

[servers.lockfile]
host = "localhost"
port = "local"
scanMode           = ["fast"]
scanModules        = ["lockfile"]
lockfiles = [
    "C:\\Users\\vagrant\\Downloads\\package-lock.json",
    "C:\\Users\\vagrant\\Downloads\\log4j-core-2.13.0.jar"
]
"@ | Set-Content config.toml

PS C:\Users\vagrant> .\vuls.exe scan
...
Scan Summary
================
lockfile        windowsWindows 11 Version 24H2 for x64-based Systems    0 installed, 0 updatable        251 libs      

PS C:\Users\vagrant> cat .\results\2025-09-04T07-46-16-0700\lockfile.json | Select-String -SimpleMatch '"path": "C:\\Users\\vagrant\\Downloads\\'

            "path": "C:\\Users\\vagrant\\Downloads\\package-lock.json"
            "path": "C:\\Users\\vagrant\\Downloads\\log4j-core-2.13.0.jar"

remote scan (linux -> windows:CMD)

$ cat << EOS > config.toml
version = "v2"

[default]

[servers]

[servers.lockfile]
host = "127.0.0.1"
port = "2222"
user = "vagrant"
keyPath = "/home/vuls/.ssh/id_rsa"
scanMode           = ["fast"]
scanModules        = ["lockfile"]
lockfiles = [
    "C:\\Users\\vagrant\\Downloads\\package-lock.json",
    "C:\\Users\\vagrant\\Downloads\\log4j-core-2.13.0.jar"
]
EOS

$ ./vuls scan
...
Scan Summary
================
lockfile        windowsWindows 11 Version 24H2 for x64-based Systems    0 installed, 0 updatable        251 libs 

$ jq -r '.libraries[].path' results/2025-09-04T23-51-31+0900/lockfile.json 
C:\Users\vagrant\Downloads\package-lock.json
C:\Users\vagrant\Downloads\log4j-core-2.13.0.jar

Checklist:

You don't have to satisfy all of the following.

• Write tests
• Write documentation
• Check that there aren't other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

Is this ready for review?: YES

Reference

[shino]

🥂 🎊