From edf33d592fa6154757d89c65a40e1f900c3ce94f Mon Sep 17 00:00:00 2001 From: Simar Date: Fri, 18 Oct 2024 00:04:42 -0600 Subject: [PATCH 1/3] feat(misconf): Show misconfig ID in output --- pkg/report/table/misconfig.go | 3 +++ pkg/report/table/misconfig_test.go | 9 +++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/pkg/report/table/misconfig.go b/pkg/report/table/misconfig.go index 112d783d0875..fa2f4db4fdbf 100644 --- a/pkg/report/table/misconfig.go +++ b/pkg/report/table/misconfig.go @@ -124,6 +124,9 @@ func (r *misconfigRenderer) renderSummary(misconf types.DetectedMisconfiguration } } + // ID + r.printf("%s\r\n", misconf.ID) + // severity switch misconf.Severity { case severityCritical: diff --git a/pkg/report/table/misconfig_test.go b/pkg/report/table/misconfig_test.go index a57399f0e253..5e22549de744 100644 --- a/pkg/report/table/misconfig_test.go +++ b/pkg/report/table/misconfig_test.go @@ -44,6 +44,7 @@ my-file () Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0) +AVD-XYZ-0123 HIGH: Oh no, a bad config. ════════════════════════════════════════ Your config file is not good. @@ -103,6 +104,7 @@ my-file () Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0) +AVD-XYZ-0123 HIGH: Oh no, a bad config. ════════════════════════════════════════ Your config file is not good. @@ -174,7 +176,8 @@ my-file () Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0) -FAIL: HIGH: Oh no, a bad config. +FAIL: AVD-XYZ-0123 +HIGH: Oh no, a bad config. ════════════════════════════════════════ Your config file is not good. @@ -188,7 +191,8 @@ See https://google.com/search?q=bad%20config ──────────────────────────────────────── -PASS: MEDIUM: Oh no, a bad config AGAIN. +PASS: AVD-XYZ-0456 +MEDIUM: Oh no, a bad config AGAIN. ════════════════════════════════════════ Your config file is still not good. @@ -312,6 +316,7 @@ terraform-aws-modules/security-group/aws/main.tf (terraform) Tests: 6 (SUCCESSES: 5, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1) +AVD-AWS-0107 CRITICAL: Security group rule allows ingress from public internet. ════════════════════════════════════════ Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible. From 051313724443c3cdc7b2167ed60356931662663f Mon Sep 17 00:00:00 2001 From: Simar Date: Mon, 21 Oct 2024 16:09:10 -0600 Subject: [PATCH 2/3] update format --- pkg/report/table/misconfig.go | 15 ++++++--------- pkg/report/table/misconfig_test.go | 15 +++++---------- 2 files changed, 11 insertions(+), 19 deletions(-) diff --git a/pkg/report/table/misconfig.go b/pkg/report/table/misconfig.go index fa2f4db4fdbf..f575d644ee7f 100644 --- a/pkg/report/table/misconfig.go +++ b/pkg/report/table/misconfig.go @@ -124,21 +124,18 @@ func (r *misconfigRenderer) renderSummary(misconf types.DetectedMisconfiguration } } - // ID - r.printf("%s\r\n", misconf.ID) - - // severity + // ID & severity switch misconf.Severity { case severityCritical: - r.printf("%s: ", misconf.Severity) + r.printf("%s (%s): ", misconf.ID, misconf.Severity) case severityHigh: - r.printf("%s: ", misconf.Severity) + r.printf("%s (%s): ", misconf.ID, misconf.Severity) case severityMedium: - r.printf("%s: ", misconf.Severity) + r.printf("%s (%s): ", misconf.ID, misconf.Severity) case severityLow: - r.printf("%s: ", misconf.Severity) + r.printf("%s (%s): ", misconf.ID, misconf.Severity) default: - r.printf("%s: ", misconf.Severity) + r.printf("%s (%s): ", misconf.ID, misconf.Severity) } // heading diff --git a/pkg/report/table/misconfig_test.go b/pkg/report/table/misconfig_test.go index 5e22549de744..bd8310107b2d 100644 --- a/pkg/report/table/misconfig_test.go +++ b/pkg/report/table/misconfig_test.go @@ -44,8 +44,7 @@ my-file () Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0) -AVD-XYZ-0123 -HIGH: Oh no, a bad config. +AVD-XYZ-0123 (HIGH): Oh no, a bad config. ════════════════════════════════════════ Your config file is not good. @@ -104,8 +103,7 @@ my-file () Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0) -AVD-XYZ-0123 -HIGH: Oh no, a bad config. +AVD-XYZ-0123 (HIGH): Oh no, a bad config. ════════════════════════════════════════ Your config file is not good. @@ -176,8 +174,7 @@ my-file () Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0) -FAIL: AVD-XYZ-0123 -HIGH: Oh no, a bad config. +FAIL: AVD-XYZ-0123 (HIGH): Oh no, a bad config. ════════════════════════════════════════ Your config file is not good. @@ -191,8 +188,7 @@ See https://google.com/search?q=bad%20config ──────────────────────────────────────── -PASS: AVD-XYZ-0456 -MEDIUM: Oh no, a bad config AGAIN. +PASS: AVD-XYZ-0456 (MEDIUM): Oh no, a bad config AGAIN. ════════════════════════════════════════ Your config file is still not good. @@ -316,8 +312,7 @@ terraform-aws-modules/security-group/aws/main.tf (terraform) Tests: 6 (SUCCESSES: 5, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1) -AVD-AWS-0107 -CRITICAL: Security group rule allows ingress from public internet. +AVD-AWS-0107 (CRITICAL): Security group rule allows ingress from public internet. ════════════════════════════════════════ Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible. From 36a5573fba4afec1fbd35c1a5da2870fb4e2ce8e Mon Sep 17 00:00:00 2001 From: Simar Date: Tue, 22 Oct 2024 23:38:53 -0600 Subject: [PATCH 3/3] use AVDID --- pkg/report/table/misconfig.go | 10 +++++----- pkg/report/table/misconfig_test.go | 11 ++++++----- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/pkg/report/table/misconfig.go b/pkg/report/table/misconfig.go index f575d644ee7f..dfb724bdf458 100644 --- a/pkg/report/table/misconfig.go +++ b/pkg/report/table/misconfig.go @@ -127,15 +127,15 @@ func (r *misconfigRenderer) renderSummary(misconf types.DetectedMisconfiguration // ID & severity switch misconf.Severity { case severityCritical: - r.printf("%s (%s): ", misconf.ID, misconf.Severity) + r.printf("%s (%s): ", misconf.AVDID, misconf.Severity) case severityHigh: - r.printf("%s (%s): ", misconf.ID, misconf.Severity) + r.printf("%s (%s): ", misconf.AVDID, misconf.Severity) case severityMedium: - r.printf("%s (%s): ", misconf.ID, misconf.Severity) + r.printf("%s (%s): ", misconf.AVDID, misconf.Severity) case severityLow: - r.printf("%s (%s): ", misconf.ID, misconf.Severity) + r.printf("%s (%s): ", misconf.AVDID, misconf.Severity) default: - r.printf("%s (%s): ", misconf.ID, misconf.Severity) + r.printf("%s (%s): ", misconf.AVDID, misconf.Severity) } // heading diff --git a/pkg/report/table/misconfig_test.go b/pkg/report/table/misconfig_test.go index bd8310107b2d..785b2621b504 100644 --- a/pkg/report/table/misconfig_test.go +++ b/pkg/report/table/misconfig_test.go @@ -27,7 +27,8 @@ func TestMisconfigRenderer(t *testing.T) { MisconfSummary: &types.MisconfSummary{Successes: 0, Failures: 1, Exceptions: 0}, Misconfigurations: []types.DetectedMisconfiguration{ { - ID: "AVD-XYZ-0123", + ID: "some-alias-for-a-check", + AVDID: "AVD-XYZ-0123", Title: "Config file is bad", Description: "Your config file is not good.", Message: "Oh no, a bad config.", @@ -61,7 +62,7 @@ See https://google.com/search?q=bad%20config MisconfSummary: &types.MisconfSummary{Successes: 0, Failures: 1, Exceptions: 0}, Misconfigurations: []types.DetectedMisconfiguration{ { - ID: "AVD-XYZ-0123", + AVDID: "AVD-XYZ-0123", Title: "Config file is bad", Description: "Your config file is not good.", Message: "Oh no, a bad config.", @@ -126,7 +127,7 @@ See https://google.com/search?q=bad%20config MisconfSummary: &types.MisconfSummary{Successes: 1, Failures: 1, Exceptions: 0}, Misconfigurations: []types.DetectedMisconfiguration{ { - ID: "AVD-XYZ-0123", + AVDID: "AVD-XYZ-0123", Title: "Config file is bad", Description: "Your config file is not good.", Message: "Oh no, a bad config.", @@ -157,7 +158,7 @@ See https://google.com/search?q=bad%20config }, }, { - ID: "AVD-XYZ-0456", + AVDID: "AVD-XYZ-0456", Title: "Config file is bad again", Description: "Your config file is still not good.", Message: "Oh no, a bad config AGAIN.", @@ -213,7 +214,7 @@ See https://google.com/search?q=bad%20config { Type: "Terraform Security Check", ID: "AVD-AWS-0107", - AVDID: "AVS-AWS-0107", + AVDID: "AVD-AWS-0107", Title: "An ingress security group rule allows traffic from /0", Description: "Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.", Message: "Security group rule allows ingress from public internet.",