feat(rego): Skip dotfiles

Fixes: aquasecurity/trivy#4924 Signed-off-by: Simar <[email protected]>
aquasecurity · Aug 4, 2023 · 69a5234 · 69a5234
1 parent aa6bb16
commit 69a5234
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/pkg/rego/embed.go b/pkg/rego/embed.go
@@ -9,7 +9,6 @@ import (
 	"github.com/aquasecurity/defsec/internal/rules"
 	rules2 "github.com/aquasecurity/defsec/rules"
 	"github.com/open-policy-agent/opa/ast"
-	"github.com/open-policy-agent/opa/bundle"
 )
 
 func init() {
@@ -88,7 +87,7 @@ func RecurseEmbeddedModules(fs embed.FS, dir string) (map[string]*ast.Module, er
 			}
 			continue
 		}
-		if !strings.HasSuffix(entry.Name(), bundle.RegoExt) || strings.HasSuffix(entry.Name(), "_test"+bundle.RegoExt) {
+		if !isRegoFile(entry.Name()) || isDotFile(entry.Name()) {
 			continue
 		}
 		fullPath := strings.Join([]string{dir, entry.Name()}, "/")

diff --git a/pkg/rego/load.go b/pkg/rego/load.go
@@ -16,6 +16,10 @@ func isRegoFile(name string) bool {
 	return strings.HasSuffix(name, bundle.RegoExt) && !strings.HasSuffix(name, "_test"+bundle.RegoExt)
 }
 
+func isDotFile(name string) bool {
+	return strings.HasPrefix(name, ".")
+}
+
 func isJSONFile(name string) bool {
 	return strings.HasSuffix(name, ".json")
 }
@@ -37,7 +41,7 @@ func (s *Scanner) loadPoliciesFromDirs(target fs.FS, paths []string) (map[string
 			if info.IsDir() {
 				return nil
 			}
-			if !isRegoFile(info.Name()) {
+			if !isRegoFile(info.Name()) || isDotFile(info.Name()) {
 				return nil
 			}
 			data, err := fs.ReadFile(target, filepath.ToSlash(path))