diff --git a/pkg/rego/load.go b/pkg/rego/load.go index 531754caf..b298eb504 100644 --- a/pkg/rego/load.go +++ b/pkg/rego/load.go @@ -48,7 +48,8 @@ func (s *Scanner) loadPoliciesFromDirs(target fs.FS, paths []string) (map[string ProcessAnnotation: true, }) if err != nil { - return err + s.debug.Log("Failed to load module: %s, err: %s", filepath.ToSlash(path), err.Error()) + return nil } modules[path] = module return nil diff --git a/pkg/rego/load_test.go b/pkg/rego/load_test.go new file mode 100644 index 000000000..af671cb93 --- /dev/null +++ b/pkg/rego/load_test.go @@ -0,0 +1,46 @@ +package rego + +import ( + "bytes" + "embed" + "testing" + + "github.com/stretchr/testify/assert" + + "github.com/aquasecurity/defsec/pkg/types" + "github.com/stretchr/testify/require" +) + +//go:embed testdata/policies +var testEmbedFS embed.FS + +func Test_RegoScanning_WithSomeInvalidPolicies(t *testing.T) { + t.Run("allow no errors", func(t *testing.T) { + var debugBuf bytes.Buffer + scanner := NewScanner(types.SourceDockerfile) + scanner.SetRegoErrorLimit(0) + scanner.SetDebugWriter(&debugBuf) + p, _ := RecurseEmbeddedModules(testEmbedFS, ".") + scanner.policies = p + + err := scanner.compilePolicies(testEmbedFS, []string{"policies"}) + require.ErrorContains(t, err, `want (one of): ["Cmd" "EndLine" "Flags" "JSON" "Original" "Path" "Stage" "StartLine" "SubCmd" "Value"]`) + assert.Contains(t, debugBuf.String(), "Error(s) occurred while loading policies") + }) + + t.Run("allow up to max 1 error", func(t *testing.T) { + var debugBuf bytes.Buffer + scanner := NewScanner(types.SourceDockerfile) + scanner.SetRegoErrorLimit(1) + scanner.SetDebugWriter(&debugBuf) + + p, _ := RecurseEmbeddedModules(testEmbedFS, ".") + scanner.policies = p + + err := scanner.compilePolicies(testEmbedFS, []string{"policies"}) + require.NoError(t, err) + + assert.Contains(t, debugBuf.String(), "Error occurred while parsing: testdata/policies/invalid.rego, testdata/policies/invalid.rego:7") + }) + +} diff --git a/pkg/rego/testdata/policies/invalid.rego b/pkg/rego/testdata/policies/invalid.rego new file mode 100644 index 000000000..c4789bc22 --- /dev/null +++ b/pkg/rego/testdata/policies/invalid.rego @@ -0,0 +1,8 @@ +# METADATA +# schemas: +# - input: schema["input"] +package defsec.test + +deny { + input.Stages[0].Commands[0].FooBarNothingBurger == "lol" +} \ No newline at end of file diff --git a/pkg/rego/testdata/policies/valid.rego b/pkg/rego/testdata/policies/valid.rego new file mode 100644 index 000000000..13b21797d --- /dev/null +++ b/pkg/rego/testdata/policies/valid.rego @@ -0,0 +1,8 @@ +# METADATA +# schemas: +# - input: schema["input"] +package defsec.test + +deny { + input.Stages[0].Commands[0].Cmd == "lol" +} \ No newline at end of file