Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(misconf): support for ignore by nested attributes #7205

Merged
merged 3 commits into from
Aug 28, 2024
Merged

feat(misconf): support for ignore by nested attributes #7205

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
582b0b4
feat(misconf): support for ignore by nested attributes
nikpivkin Jul 22, 2024
86e8b29
return the first block if no index is passed
nikpivkin Aug 7, 2024
d71e6ac
fix block access by index
nikpivkin Aug 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion pkg/iac/scanners/terraform/ignore_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -433,7 +433,7 @@ resource "bad" "my-rule" {
{
name: "ignore by dynamic block value",
inputOptions: `
// trivy:ignore:*[secure_settings.0.enabled=false]
// trivy:ignore:*[secure_settings.enabled=false]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's add these two as separate test cases so they're both documented in behavior.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done d71e6ac

resource "bad" "my-rule" {
dynamic "secure_settings" {
for_each = ["false", "true"]
Expand Down
15 changes: 11 additions & 4 deletions pkg/iac/terraform/block.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -350,12 +350,11 @@ func (b *Block) getAttributeByPath(path string) (*Attribute, []string) {
stepIndex int
)

currentBlock := b
for currentBlock != nil && stepIndex <= len(steps)-1 {
for currentBlock := b; currentBlock != nil && stepIndex < len(steps); {
blocks := currentBlock.GetBlocks(steps[stepIndex])

var nextBlock *Block
if len(blocks) == 1 {
if !hasIndex(steps, stepIndex) && len(blocks) > 0 {
// if index is not provided then return the first block for backwards compatibility
nextBlock = blocks[0]
} else if len(blocks) > 1 && stepIndex < len(steps)-2 {
// handling the case when there are multiple blocks with the same name,
Expand All @@ -378,6 +377,14 @@ func (b *Block) getAttributeByPath(path string) (*Attribute, []string) {
return attribute, steps[stepIndex:]
}

func hasIndex(steps []string, idx int) bool {
if idx < 0 || idx >= len(steps) {
return false
}
_, err := strconv.Atoi(steps[idx])
return err == nil
}

func getValueByPath(val cty.Value, path []string) (cty.Value, error) {
var err error
for _, step := range path {
Expand Down