fix(config): change selector type (fanal#189)

knqyf263 · web-flow · commit cb66108f4d90 · 2021-06-28T14:52:57.000+03:00
* fix(config): change selector type

* test(policy): fix test data
diff --git a/cmd/fanal/main.go b/cmd/fanal/main.go
@@ -60,6 +60,11 @@ func run() (err error) {
 				Aliases: []string{"fs"},
 				Usage:   "inspect a local directory",
 				Flags: []cli.Flag{
+					&cli.StringSliceFlag{
+						Name:  "namespace",
+						Usage: "namespaces",
+						Value: cli.NewStringSlice("appshield"),
+					},
 					&cli.StringSliceFlag{
 						Name:  "policy",
 						Usage: "policy paths",
@@ -141,6 +146,7 @@ func archiveAction(c *cli.Context, fsCache cache.Cache) error {
 
 func fsAction(c *cli.Context, fsCache cache.Cache) error {
 	art, err := local.NewArtifact(c.Args().First(), fsCache, nil, config.ScannerOption{
+		Namespaces:  []string{"appshield"},
 		PolicyPaths: c.StringSlice("policy"),
 	})
 	if err != nil {
@@ -189,6 +195,9 @@ func inspect(ctx context.Context, art artifact.Artifact, c cache.LocalArtifactCa
 	}
 	for _, misconf := range mergedLayer.Misconfigurations {
 		fmt.Printf("  %s: failures %d, warnings %d\n", misconf.FilePath, len(misconf.Failures), len(misconf.Warnings))
+		for _, failure := range misconf.Failures {
+			fmt.Printf("    %s: %s\n", failure.ID, failure.Message)
+		}
 	}
 	return nil
 }
diff --git a/policy/engine.go b/policy/engine.go
@@ -196,13 +196,13 @@ func (e *Engine) Check(ctx context.Context, configs []types.Config, namespaces [
 		}
 
 		var selectedConfigs []types.Config
-		if len(inputOption.Selector.Types) > 0 {
+		if len(inputOption.Selectors) > 0 {
 			// Pass only the config files that match the selector types
-			for _, t := range inputOption.Selector.Types {
+			for _, t := range uniqueSelectorTypes(inputOption.Selectors) {
 				selectedConfigs = append(selectedConfigs, typedConfigs[t]...)
 			}
 		} else {
-			// When the 'types' is not specified, it means '*'.
+			// When the 'selector' is not specified, it means '*'.
 			selectedConfigs = configs
 		}
 
@@ -666,6 +666,14 @@ func removeRulePrefix(rule string) string {
 	return rule
 }
 
+func uniqueSelectorTypes(selectors []types.PolicyInputSelector) []string {
+	selectorTypes := map[string]struct{}{}
+	for _, s := range selectors {
+		selectorTypes[s.Type] = struct{}{}
+	}
+	return utils.Keys(selectorTypes)
+}
+
 func uniqueResults(results []types.MisconfResult) []types.MisconfResult {
 	uniq := map[string]types.MisconfResult{}
 	for _, result := range results {
diff --git a/policy/testdata/combine/combined_deployment.rego b/policy/testdata/combine/combined_deployment.rego
@@ -11,8 +11,8 @@ __rego_metadata__ := {
 }
 
 __rego_input__ := {
-	"selector": {"types": ["kubernetes"]},
 	"combine": true,
+	"selector": [{"type": "kubernetes"}],
 }
 
 deny[res] {
diff --git a/policy/testdata/combine/combined_docker.rego b/policy/testdata/combine/combined_docker.rego
@@ -11,8 +11,8 @@ __rego_metadata__ := {
 }
 
 __rego_input__ := {
-	"selector": {"types": ["dockerfile"]},
 	"combine": true,
+	"selector": [{"type": "dockerfile"}],
 }
 
 deny[res] {
diff --git a/policy/testdata/combine/combined_pod.rego b/policy/testdata/combine/combined_pod.rego
@@ -1,22 +1,20 @@
 package testdata.xyz_400
 
 __rego_metadata__ := {
-    "id": "XYZ-400",
-    "title": "Bad Combined Pod",
-    "version": "v1.0.0",
-    "severity": "LOW",
-    "type": "Kubernetes Security Check",
+	"id": "XYZ-400",
+	"title": "Bad Combined Pod",
+	"version": "v1.0.0",
+	"severity": "LOW",
+	"type": "Kubernetes Security Check",
 }
 
 __rego_input__ := {
-    "selector": {
-        "types": ["kubernetes"]
-    },
-    "combine": true,
+	"combine": true,
+	"selector": [{"type": "kubernetes"}],
 }
 
 deny[res] {
-    input[i].contents.kind == "Pod"
+	input[i].contents.kind == "Pod"
 	res := {
 		"filepath": input[i].path,
 		"msg": sprintf("deny combined %s", [input[i].contents.metadata.name]),
diff --git a/policy/testdata/combine/deployment.rego b/policy/testdata/combine/deployment.rego
@@ -11,8 +11,8 @@ __rego_metadata__ := {
 }
 
 __rego_input__ := {
-	"selector": {"types": ["kubernetes"]},
 	"combine": false,
+	"selector": [{"type": "kubernetes"}],
 }
 
 warn[msg] {
diff --git a/policy/testdata/combine_exception/combined_deployment.rego b/policy/testdata/combine_exception/combined_deployment.rego
@@ -11,8 +11,8 @@ __rego_metadata__ := {
 }
 
 __rego_input__ := {
-	"selector": {"types": ["kubernetes"]},
 	"combine": true,
+	"selector": [{"type": "kubernetes"}],
 }
 
 warn[res] {
diff --git a/policy/testdata/combine_exception/deployment.rego b/policy/testdata/combine_exception/deployment.rego
@@ -11,8 +11,8 @@ __rego_metadata__ := {
 }
 
 __rego_input__ := {
-	"selector": {"types": ["kubernetes"]},
 	"combine": false,
+	"selector": [{"type": "kubernetes"}],
 }
 
 warn[msg] {
diff --git a/policy/testdata/combine_exception/exceptions.rego b/policy/testdata/combine_exception/exceptions.rego
@@ -3,6 +3,6 @@ package namespace.exceptions
 import data.namespaces
 
 exception[ns] {
-    ns := data.namespaces[_]
-    ns == "testdata.xyz_300"
+	ns := data.namespaces[_]
+	ns == "testdata.xyz_300"
 }
diff --git a/policy/testdata/combine_exception/fail.rego b/policy/testdata/combine_exception/fail.rego
@@ -11,8 +11,8 @@ __rego_metadata__ := {
 }
 
 __rego_input__ := {
-	"selector": {"types": ["kubernetes"]},
 	"combine": true,
+	"selector": [{"type": "kubernetes"}],
 }
 
 deny[res] {
diff --git a/policy/testdata/happy/deployment.rego b/policy/testdata/happy/deployment.rego
@@ -3,22 +3,20 @@ package testdata.xyz_100
 import data.services
 
 __rego_metadata__ := {
-    "id": "XYZ-100",
-    "title": "Bad Deployment",
-    "version": "v1.0.0",
-    "severity": "HIGH",
-    "type": "Kubernetes Security Check",
+	"id": "XYZ-100",
+	"title": "Bad Deployment",
+	"version": "v1.0.0",
+	"severity": "HIGH",
+	"type": "Kubernetes Security Check",
 }
 
 __rego_input__ := {
-    "selector": {
-        "types": ["kubernetes"]
-    },
-    "combine": false,
+	"combine": false,
+	"selector": [{"type": "kubernetes"}],
 }
 
 deny[msg] {
-  input.kind == "Deployment"
-  services.ports[_] == 22
-  msg := sprintf("deny %s", [input.metadata.name])
+	input.kind == "Deployment"
+	services.ports[_] == 22
+	msg := sprintf("deny %s", [input.metadata.name])
 }
diff --git a/policy/testdata/happy/docker.rego b/policy/testdata/happy/docker.rego
@@ -1,20 +1,18 @@
 package testdata.xyz_200
 
 __rego_metadata__ := {
-    "id": "XYZ-200",
-    "title": "Bad FROM",
-    "version": "v1.0.0",
-    "severity": "LOW",
-    "type": "Docker Security Check",
+	"id": "XYZ-200",
+	"title": "Bad FROM",
+	"version": "v1.0.0",
+	"severity": "LOW",
+	"type": "Docker Security Check",
 }
 
 __rego_input__ := {
-    "selector": {
-        "types": ["dockerfile"]
-    },
-    "combine": false,
+	"combine": false,
+	"selector": [{"type": "dockerfile"}],
 }
 
 deny[msg] {
-  msg := "bad Dockerfile"
+	msg := "bad Dockerfile"
 }
diff --git a/policy/testdata/happy/pod.rego b/policy/testdata/happy/pod.rego
@@ -1,21 +1,19 @@
 package testdata.xyz_300
 
 __rego_metadata__ := {
-    "id": "XYZ-300",
-    "title": "Bad Pod",
-    "version": "v1.0.0",
-    "severity": "CRITICAL",
-    "type": "Kubernetes Security Check",
+	"id": "XYZ-300",
+	"title": "Bad Pod",
+	"version": "v1.0.0",
+	"severity": "CRITICAL",
+	"type": "Kubernetes Security Check",
 }
 
 __rego_input__ := {
-    "selector": {
-        "types": ["kubernetes"]
-    },
-    "combine": false,
+	"combine": false,
+	"selector": [{"type": "kubernetes"}],
 }
 
 deny[msg] {
-  input.kind == "Pod"
-  msg := sprintf("deny %s", [input.metadata.name])
+	input.kind == "Pod"
+	msg := sprintf("deny %s", [input.metadata.name])
 }
diff --git a/policy/testdata/namespace_exception/100.rego b/policy/testdata/namespace_exception/100.rego
@@ -1,14 +1,14 @@
 package testdata.kubernetes.xyz_100
 
 __rego_metadata__ := {
-    "id": "XYZ-100",
-    "title": "Bad Deployment",
-    "version": "v1.0.0",
-    "severity": "HIGH",
-    "type": "Kubernetes Security Check",
+	"id": "XYZ-100",
+	"title": "Bad Deployment",
+	"version": "v1.0.0",
+	"severity": "HIGH",
+	"type": "Kubernetes Security Check",
 }
 
 deny[msg] {
-  input.kind == "Deployment"
-  msg := sprintf("deny 100 %s", [input.metadata.name])
-}
+	input.kind == "Deployment"
+	msg := sprintf("deny 100 %s", [input.metadata.name])
+}
diff --git a/policy/testdata/namespace_exception/200.rego b/policy/testdata/namespace_exception/200.rego
@@ -1,14 +1,14 @@
 package testdata.kubernetes.xyz_200
 
 __rego_metadata__ := {
-    "id": "XYZ-200",
-    "title": "Bad Deployment",
-    "version": "v1.0.0",
-    "severity": "HIGH",
-    "type": "Kubernetes Security Check",
+	"id": "XYZ-200",
+	"title": "Bad Deployment",
+	"version": "v1.0.0",
+	"severity": "HIGH",
+	"type": "Kubernetes Security Check",
 }
 
 deny[res] {
-  input.kind == "Deployment"
-  res := {"msg": sprintf("deny 200 %s", [input.metadata.name])}
-}
+	input.kind == "Deployment"
+	res := {"msg": sprintf("deny 200 %s", [input.metadata.name])}
+}
diff --git a/policy/testdata/namespace_exception/exceptions.rego b/policy/testdata/namespace_exception/exceptions.rego
@@ -3,6 +3,6 @@ package namespace.exceptions
 import data.namespaces
 
 exception[ns] {
-    ns := data.namespaces[_]
-    ns == "testdata.kubernetes.xyz_100"
+	ns := data.namespaces[_]
+	ns == "testdata.kubernetes.xyz_100"
 }
diff --git a/policy/testdata/rule_exception/deployment.rego b/policy/testdata/rule_exception/deployment.rego
@@ -1,23 +1,23 @@
 package testdata.kubernetes.xyz_100
 
 __rego_metadata__ := {
-    "id": "XYZ-100",
-    "title": "Bad Deployment",
-    "version": "v1.0.0",
-    "severity": "HIGH",
-    "type": "Kubernetes Security Check",
+	"id": "XYZ-100",
+	"title": "Bad Deployment",
+	"version": "v1.0.0",
+	"severity": "HIGH",
+	"type": "Kubernetes Security Check",
 }
 
 deny_foo[msg] {
-  input.kind == "Deployment"
-  msg := sprintf("deny foo %s", [input.metadata.name])
+	input.kind == "Deployment"
+	msg := sprintf("deny foo %s", [input.metadata.name])
 }
 
 deny_bar[msg] {
-  input.kind == "Deployment"
-  msg := sprintf("deny bar %s", [input.metadata.name])
+	input.kind == "Deployment"
+	msg := sprintf("deny bar %s", [input.metadata.name])
 }
 
 exception[rules] {
-  rules = ["foo"]
-}
+	rules = ["foo"]
+}
diff --git a/policy/testdata/sad/broken_metadata.rego b/policy/testdata/sad/broken_metadata.rego
@@ -3,6 +3,6 @@ package testdata.kubernetes.xyz_100
 __rego_metadata__ := "broken"
 
 deny[msg] {
-  input.kind == "Deployment"
-  msg := sprintf("deny %s", [input.metadata.name])
+	input.kind == "Deployment"
+	msg := sprintf("deny %s", [input.metadata.name])
 }
diff --git a/policy/testdata/sad/broken_msg.rego b/policy/testdata/sad/broken_msg.rego
@@ -1,14 +1,14 @@
 package testdata.kubernetes.xyz_200
 
 __rego_metadata__ := {
-    "id": "XYZ-200",
-    "title": "Bad Deployment",
-    "version": "v1.0.0",
-    "severity": "HIGH",
-    "type": "Kubernetes Security Check",
+	"id": "XYZ-200",
+	"title": "Bad Deployment",
+	"version": "v1.0.0",
+	"severity": "HIGH",
+	"type": "Kubernetes Security Check",
 }
 
 deny[res] {
-  input.kind == "Deployment"
-  res := {"hello": "world"}
-}
+	input.kind == "Deployment"
+	res := {"hello": "world"}
+}
diff --git a/policy/testdata/sad/broken_rule.rego b/policy/testdata/sad/broken_rule.rego
@@ -1,5 +1,5 @@
 package testdata.kubernetes.xyz_100
 
 deny[msg] {
-    broken
+	broken
 }
diff --git a/policy/testdata/sad/missing_filepath.rego b/policy/testdata/sad/missing_filepath.rego
diff --git a/policy/testdata/sad/missing_metadata.rego b/policy/testdata/sad/missing_metadata.rego
diff --git a/policy/testdata/sad/missing_metadata_fields.rego b/policy/testdata/sad/missing_metadata_fields.rego
diff --git a/types/misconf.go b/types/misconf.go
diff --git a/utils/utils.go b/utils/utils.go

Original file line number	Diff line number	Diff line change
`@@ -11,8 +11,8 @@ __rego_metadata__ := {`
`11`	`11`	`}`
`12`	`12`
`13`	`13`	`__rego_input__ := {`
`14`		`- "selector": {"types": ["kubernetes"]},`
`15`	`14`	`"combine": true,`
	`15`	`+ "selector": [{"type": "kubernetes"}],`
`16`	`16`	`}`
`17`	`17`
`18`	`18`	`deny[res] {`
Original file line number	Diff line number	Diff line change
`@@ -3,6 +3,6 @@ package namespace.exceptions`
`3`	`3`	`import data.namespaces`
`4`	`4`
`5`	`5`	`exception[ns] {`
`6`		`- ns := data.namespaces[_]`
`7`		`- ns == "testdata.xyz_300"`
	`6`	`+ ns := data.namespaces[_]`
	`7`	`+ ns == "testdata.xyz_300"`
`8`	`8`	`}`