Skip to content

Commit bb5abd4

Browse files
owenrumneyowenrumney
authored
Merge pull request fanal#336 from aquasecurity/owenr-update-tfsec-and-cfsec
chore(deps): updating code scanning
2 parents 6793d65 + 18d683a commit bb5abd4

File tree

5 files changed

+77
-30
lines changed

5 files changed

+77
-30
lines changed

‎config/scanner/scanner.go

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ func (s Scanner) scanCloudFormationByCFSec(files []types.Config) ([]types.Miscon
135135
misconfResult := types.MisconfResult{
136136
Message: result.Description,
137137
PolicyMetadata: types.PolicyMetadata{
138-
ID: result.AVDID,
138+
ID: result.RuleID,
139139
Type: "Cloudformation Security Check powered by cfsec",
140140
Title: result.RuleSummary,
141141
Description: result.Impact,
@@ -145,14 +145,21 @@ func (s Scanner) scanCloudFormationByCFSec(files []types.Config) ([]types.Miscon
145145
},
146146
IacMetadata: types.IacMetadata{
147147
Resource: result.Resource,
148+
Provider: result.RuleProvider.DisplayName(),
149+
Service: result.RuleService,
148150
StartLine: result.Location.StartLine,
149151
EndLine: result.Location.EndLine,
150152
},
151153
}
152154

153-
filePath, err := filepath.Rel(rootDir, result.Location.Filename)
155+
filename := result.Location.Filename
156+
if filename == "" {
157+
filename = file.FilePath
158+
}
159+
160+
filePath, err := filepath.Rel(rootDir, filename)
154161
if err != nil {
155-
return nil, xerrors.Errorf("filepath rel: %w", err)
162+
return nil, xerrors.Errorf("filepath rel, root: [%s], result: [%s] %w", rootDir, file.FilePath, err)
156163
}
157164

158165
misconf, ok := misConfs[filePath]
@@ -211,11 +218,12 @@ func (s Scanner) scanTerraformByTFSec(files []types.Config) ([]types.Misconfigur
211218
},
212219
IacMetadata: types.IacMetadata{
213220
Resource: result.Resource,
221+
Provider: result.RuleProvider.DisplayName(),
222+
Service: result.RuleService,
214223
StartLine: result.Location.StartLine,
215224
EndLine: result.Location.EndLine,
216225
},
217226
}
218-
219227
filePath, err := filepath.Rel(rootDir, result.Range().Filename)
220228
if err != nil {
221229
return nil, xerrors.Errorf("filepath rel: %w", err)

‎config/scanner/scanner_test.go

Lines changed: 50 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,8 @@ func TestScanner_ScanConfig(t *testing.T) {
8585
},
8686
IacMetadata: types.IacMetadata{
8787
Resource: "S3Bucket",
88+
Provider: "AWS",
89+
Service: "s3",
8890
StartLine: 12,
8991
EndLine: 24,
9092
},
@@ -101,6 +103,8 @@ func TestScanner_ScanConfig(t *testing.T) {
101103
References: []string{"https://cfsec.dev/docs/s3/no-public-access-with-acl/#s3", "https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.html"},
102104
}, IacMetadata: types.IacMetadata{
103105
Resource: "S3Bucket",
106+
Provider: "AWS",
107+
Service: "s3",
104108
StartLine: 12,
105109
EndLine: 24,
106110
},
@@ -118,6 +122,8 @@ func TestScanner_ScanConfig(t *testing.T) {
118122
},
119123
IacMetadata: types.IacMetadata{
120124
Resource: "S3Bucket",
125+
Provider: "AWS",
126+
Service: "s3",
121127
StartLine: 12,
122128
EndLine: 24,
123129
},
@@ -137,8 +143,10 @@ func TestScanner_ScanConfig(t *testing.T) {
137143
},
138144
IacMetadata: types.IacMetadata{
139145
Resource: "S3Bucket",
140-
StartLine: 12,
141-
EndLine: 24,
146+
Provider: "AWS",
147+
Service: "s3",
148+
StartLine: 18,
149+
EndLine: 18,
142150
},
143151
},
144152
{
@@ -154,8 +162,10 @@ func TestScanner_ScanConfig(t *testing.T) {
154162
},
155163
IacMetadata: types.IacMetadata{
156164
Resource: "S3Bucket",
157-
StartLine: 12,
158-
EndLine: 24,
165+
Provider: "AWS",
166+
Service: "s3",
167+
StartLine: 19,
168+
EndLine: 19,
159169
},
160170
},
161171
{
@@ -171,7 +181,9 @@ func TestScanner_ScanConfig(t *testing.T) {
171181
},
172182
IacMetadata: types.IacMetadata{
173183
Resource: "S3Bucket",
174-
StartLine: 12,
184+
Provider: "AWS",
185+
Service: "s3",
186+
StartLine: 24,
175187
EndLine: 24,
176188
},
177189
},
@@ -188,6 +200,8 @@ func TestScanner_ScanConfig(t *testing.T) {
188200
},
189201
IacMetadata: types.IacMetadata{
190202
Resource: "S3Bucket",
203+
Provider: "AWS",
204+
Service: "s3",
191205
StartLine: 12,
192206
EndLine: 24,
193207
},
@@ -205,6 +219,8 @@ func TestScanner_ScanConfig(t *testing.T) {
205219
},
206220
IacMetadata: types.IacMetadata{
207221
Resource: "S3Bucket",
222+
Provider: "AWS",
223+
Service: "s3",
208224
StartLine: 12,
209225
EndLine: 24,
210226
},
@@ -222,8 +238,10 @@ func TestScanner_ScanConfig(t *testing.T) {
222238
},
223239
IacMetadata: types.IacMetadata{
224240
Resource: "S3Bucket",
225-
StartLine: 12,
226-
EndLine: 24,
241+
Provider: "AWS",
242+
Service: "s3",
243+
StartLine: 21,
244+
EndLine: 21,
227245
},
228246
},
229247
},
@@ -253,6 +271,8 @@ func TestScanner_ScanConfig(t *testing.T) {
253271
},
254272
IacMetadata: types.IacMetadata{
255273
Resource: "aws_security_group_rule.my-rule",
274+
Provider: "AWS",
275+
Service: "vpc",
256276
StartLine: 1,
257277
EndLine: 4,
258278
},
@@ -268,6 +288,8 @@ func TestScanner_ScanConfig(t *testing.T) {
268288
},
269289
IacMetadata: types.IacMetadata{
270290
Resource: "aws_security_group_rule.my-rule",
291+
Provider: "AWS",
292+
Service: "vpc",
271293
StartLine: 1,
272294
EndLine: 4,
273295
},
@@ -283,6 +305,8 @@ func TestScanner_ScanConfig(t *testing.T) {
283305
},
284306
IacMetadata: types.IacMetadata{
285307
Resource: "aws_security_group_rule.my-rule",
308+
Provider: "General",
309+
Service: "secrets",
286310
StartLine: 1,
287311
EndLine: 4,
288312
},
@@ -298,6 +322,8 @@ func TestScanner_ScanConfig(t *testing.T) {
298322
},
299323
IacMetadata: types.IacMetadata{
300324
Resource: "azurerm_managed_disk.source",
325+
Provider: "General",
326+
Service: "secrets",
301327
StartLine: 10,
302328
EndLine: 14,
303329
},
@@ -313,6 +339,8 @@ func TestScanner_ScanConfig(t *testing.T) {
313339
},
314340
IacMetadata: types.IacMetadata{
315341
Resource: "aws_security_group_rule.my-rule",
342+
Provider: "General",
343+
Service: "secrets",
316344
StartLine: 1,
317345
EndLine: 4,
318346
},
@@ -328,6 +356,8 @@ func TestScanner_ScanConfig(t *testing.T) {
328356
},
329357
IacMetadata: types.IacMetadata{
330358
Resource: "azurerm_managed_disk.source",
359+
Provider: "General",
360+
Service: "secrets",
331361
StartLine: 10,
332362
EndLine: 14,
333363
},
@@ -344,6 +374,8 @@ func TestScanner_ScanConfig(t *testing.T) {
344374
},
345375
IacMetadata: types.IacMetadata{
346376
Resource: "variable.enableEncryption",
377+
Provider: "General",
378+
Service: "secrets",
347379
StartLine: 6,
348380
EndLine: 8,
349381
},
@@ -359,6 +391,8 @@ func TestScanner_ScanConfig(t *testing.T) {
359391
},
360392
IacMetadata: types.IacMetadata{
361393
Resource: "variable.enableEncryption",
394+
Provider: "General",
395+
Service: "secrets",
362396
StartLine: 6,
363397
EndLine: 8,
364398
},
@@ -375,14 +409,16 @@ func TestScanner_ScanConfig(t *testing.T) {
375409
RecommendedActions: "Add descriptions for all security groups and rules",
376410
Severity: "LOW",
377411
References: []string{
378-
"https://tfsec.dev/docs/aws/vpc/add-description-to-security-group#aws/vpc",
412+
"https://aquasecurity.github.io/tfsec/latest/checks/aws/vpc/add-description-to-security-group",
379413
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group",
380414
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule",
381415
"https://www.cloudconformity.com/knowledge-base/aws/EC2/security-group-rules-description.html",
382416
},
383417
},
384418
IacMetadata: types.IacMetadata{
385419
Resource: "aws_security_group_rule.my-rule",
420+
Provider: "AWS",
421+
Service: "vpc",
386422
StartLine: 1,
387423
EndLine: 4,
388424
},
@@ -397,13 +433,15 @@ func TestScanner_ScanConfig(t *testing.T) {
397433
RecommendedActions: "Set a more restrictive cidr range",
398434
Severity: "CRITICAL",
399435
References: []string{
400-
"https://tfsec.dev/docs/aws/vpc/no-public-ingress-sgr#aws/vpc",
436+
"https://aquasecurity.github.io/tfsec/latest/checks/aws/vpc/no-public-ingress-sgr",
401437
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks",
402438
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html",
403439
},
404440
},
405441
IacMetadata: types.IacMetadata{
406442
Resource: "aws_security_group_rule.my-rule",
443+
Provider: "AWS",
444+
Service: "vpc",
407445
StartLine: 3,
408446
EndLine: 3,
409447
},
@@ -418,13 +456,15 @@ func TestScanner_ScanConfig(t *testing.T) {
418456
RecommendedActions: "Enable encryption on managed disks",
419457
Severity: "HIGH",
420458
References: []string{
421-
"https://tfsec.dev/docs/azure/compute/enable-disk-encryption#azure/compute",
459+
"https://aquasecurity.github.io/tfsec/latest/checks/azure/compute/enable-disk-encryption",
422460
"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/managed_disk",
423461
"https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption",
424462
},
425463
},
426464
IacMetadata: types.IacMetadata{
427465
Resource: "azurerm_managed_disk.source",
466+
Provider: "Azure",
467+
Service: "compute",
428468
StartLine: 12,
429469
EndLine: 12,
430470
},

‎go.mod

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@ require (
66
github.com/BurntSushi/toml v0.4.1
77
github.com/GoogleCloudPlatform/docker-credential-gcr v1.5.0
88
github.com/alicebob/miniredis/v2 v2.16.0
9-
github.com/aquasecurity/cfsec v0.0.12
10-
github.com/aquasecurity/defsec v0.0.30
9+
github.com/aquasecurity/cfsec v0.2.2
10+
github.com/aquasecurity/defsec v0.0.37
1111
github.com/aquasecurity/go-dep-parser v0.0.0-20211110174639-8257534ffed3
1212
github.com/aquasecurity/testdocker v0.0.0-20210911155206-e1e85f5a1516
13-
github.com/aquasecurity/tfsec v0.59.0
13+
github.com/aquasecurity/tfsec v0.61.4-0.20211130135821-0a1997e494fa
1414
github.com/aws/aws-sdk-go v1.42.0
1515
github.com/docker/docker v20.10.10+incompatible
1616
github.com/docker/go-connections v0.4.0

‎go.sum

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -190,19 +190,18 @@ github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/
190190
github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
191191
github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
192192
github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
193-
github.com/aquasecurity/cfsec v0.0.12 h1:6zvaJ34qKbElT5CyeMDre5WxtphPCt+XXKqz0Atj14s=
194-
github.com/aquasecurity/cfsec v0.0.12/go.mod h1:26CqZRuXnPWAEqN2duORHQAPfz8Fh5FjVE+AT0wu78k=
195-
github.com/aquasecurity/defsec v0.0.30 h1:7GSGUUH0xeWRlyLeksdYz+PLZqQu6taICzapGvdlu4c=
196-
github.com/aquasecurity/defsec v0.0.30/go.mod h1:E53TX/xJkcgpJyF5GPSat3Z+cZiLyvSNBdJAyfdl3fc=
197-
github.com/aquasecurity/go-dep-parser v0.0.0-20211013074621-eb58e8565220 h1:4ck6/2PNmzcNPUgFT3gCq6oVFB/Do/qiasRuBL9xGDI=
198-
github.com/aquasecurity/go-dep-parser v0.0.0-20211013074621-eb58e8565220/go.mod h1:Zc7Eo6tFl9l4XcqsWeabD7jHnXRBK/LdgZuu9GTSVLU=
193+
github.com/aquasecurity/cfsec v0.2.2 h1:hq6MZlg7XFZsrerCv297N4HRlnJM7K6LLd/l/xCz1no=
194+
github.com/aquasecurity/cfsec v0.2.2/go.mod h1:sUELRJqIPXTOZiHUx7TzyyFFzuk0W22IG6IWAoV8T6U=
195+
github.com/aquasecurity/defsec v0.0.37 h1:zdZndlKrW257b8VLK1UwfmXiyPuDrNA+wzBilHRk1LA=
196+
github.com/aquasecurity/defsec v0.0.37/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
199197
github.com/aquasecurity/go-dep-parser v0.0.0-20211110174639-8257534ffed3 h1:zYNhYU4HUqJq+Lqhwf68gvd+v0cKqM2XOmggtHYLkoU=
200198
github.com/aquasecurity/go-dep-parser v0.0.0-20211110174639-8257534ffed3/go.mod h1:Zc7Eo6tFl9l4XcqsWeabD7jHnXRBK/LdgZuu9GTSVLU=
201199
github.com/aquasecurity/testdocker v0.0.0-20210911155206-e1e85f5a1516 h1:moQmzbpLo5dxHQCyEhqzizsDSNrNhn/7uRTCZzo4A1o=
202200
github.com/aquasecurity/testdocker v0.0.0-20210911155206-e1e85f5a1516/go.mod h1:gTd97VdQ0rg8Mkiic3rPgNOQdprZ7feTAhiD5mGQjgM=
203-
github.com/aquasecurity/tfsec v0.58.14/go.mod h1:RcgH8QFJSE+p7Sf/WAF7chGTL/xULi7muiNdqIsUkOE=
204-
github.com/aquasecurity/tfsec v0.59.0 h1:HATgpKbiUEWnJ8PU3CJpHMJCEhVgJG9E32m7uEp44oo=
205-
github.com/aquasecurity/tfsec v0.59.0/go.mod h1:MR3uDlWu+fBTisFndR+NwjSGt06RBhkE++JzKRJ0Ggs=
201+
github.com/aquasecurity/tfsec v0.61.3 h1:jaBuFaq/0YDDqHeTR+SkD/A1XShN0+9W9/rPGlw7kmQ=
202+
github.com/aquasecurity/tfsec v0.61.3/go.mod h1:MR3uDlWu+fBTisFndR+NwjSGt06RBhkE++JzKRJ0Ggs=
203+
github.com/aquasecurity/tfsec v0.61.4-0.20211130135821-0a1997e494fa h1:mgG6allqccyBmaE0qnWFl39ju156yqNVTd0D/xwuVko=
204+
github.com/aquasecurity/tfsec v0.61.4-0.20211130135821-0a1997e494fa/go.mod h1:MR3uDlWu+fBTisFndR+NwjSGt06RBhkE++JzKRJ0Ggs=
206205
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
207206
github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
208207
github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
@@ -1075,7 +1074,6 @@ github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTm
10751074
github.com/openzipkin/zipkin-go v0.1.3/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
10761075
github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
10771076
github.com/owenrumney/go-sarif v1.0.10/go.mod h1:sgJM0ZaZ28jT8t8Iq3/mUCFBW9cX09EobIBXYOhiYBc=
1078-
github.com/owenrumney/go-sarif v1.0.11/go.mod h1:hTBFbxU7GuVRUvwMx+eStp9M/Oun4xHCS3vqpPvket8=
10791077
github.com/owenrumney/go-sarif v1.0.12/go.mod h1:Jk5smXU9QuCqTdh4N3PehnG+azzrf0XcQ267ZwAG8Ho=
10801078
github.com/owenrumney/squealer v0.2.28 h1:LYsqUHal+5QlANjbZ+h44SN5kIZSfHCWKUzBAS1KwB0=
10811079
github.com/owenrumney/squealer v0.2.28/go.mod h1:wwVPzhjiUBILIdDtnzGSEcapXczIj/tONP+ZJ49IhPY=
@@ -1335,7 +1333,6 @@ github.com/zclconf/go-cty v1.2.0/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q
13351333
github.com/zclconf/go-cty v1.6.1/go.mod h1:VDR4+I79ubFBGm1uJac1226K5yANQFHeauxPBoP54+o=
13361334
github.com/zclconf/go-cty v1.8.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
13371335
github.com/zclconf/go-cty v1.8.3/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
1338-
github.com/zclconf/go-cty v1.8.4/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
13391336
github.com/zclconf/go-cty v1.9.1/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
13401337
github.com/zclconf/go-cty v1.10.0 h1:mp9ZXQeIcN8kAwuqorjH+Q+njbJKjLrvB2yIh4q7U+0=
13411338
github.com/zclconf/go-cty v1.10.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=

‎types/misconf.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,10 @@ type MisconfResults []MisconfResult
3030

3131
type IacMetadata struct {
3232
Resource string `json:",omitempty"`
33-
StartLine int `json:",omitempty"`
34-
EndLine int `json:",omitempty"`
33+
Provider string `json:",omitempty"`
34+
Service string `json:",omitempty"`
35+
StartLine int `json:",omitempty"`
36+
EndLine int `json:",omitempty"`
3537
}
3638

3739
type PolicyMetadata struct {

0 commit comments

Comments
 (0)