Skip to content

Commit

Permalink
Merge pull request #6773 from Checkmarx/joaom/kics-988
Browse files Browse the repository at this point in the history 
feat(engine): improve detection of Ansible files
  • Loading branch information
@asofsilva
asofsilva authored Nov 6, 2023
2 parents fe05f97 + dc64f00 commit 5131c60
Show file tree
Hide file tree
Showing 2 changed files with 51 additions and 14 deletions.
33 changes: 29 additions & 4 deletions pkg/analyzer/analyzer.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ var (
pulumiRuntimeRegex = regexp.MustCompile(`runtime\s*:`)
pulumiResourcesRegex = regexp.MustCompile(`resources\s*:`)
serverlessServiceRegex = regexp.MustCompile(`service\s*:`)
serverlessProviderRegex = regexp.MustCompile(`provider\s*:`)
serverlessProviderRegex = regexp.MustCompile(`(^|\n)provider\s*:`)
cicdOnRegex = regexp.MustCompile(`\s*on:\s*`)
cicdJobsRegex = regexp.MustCompile(`\s*jobs:\s*`)
cicdStepsRegex = regexp.MustCompile(`\s*steps:\s*`)
Expand Down Expand Up @@ -100,6 +100,10 @@ var (
"pulumi": {"pulumi"},
"serverlessfw": {"serverlessfw"},
}
listKeywordsAnsible = []string{"name", "gather_facts",
"hosts", "tasks", "become", "with_items", "with_dict",
"when", "become_pass", "become_exe", "become_flags"}
playBooks = "playbooks"
)

const (
Expand Down Expand Up @@ -543,9 +547,30 @@ func checkYamlPlatform(content []byte, path string) string {
}
}

// Since Ansible has no defining property
// and no other type matched for YAML file extension, assume the file type is Ansible
return ansible
// check if the file contains some keywords related with Ansible
if checkForAnsible(yamlContent) {
return ansible
}
return ""
}

func checkForAnsible(yamlContent model.Document) bool {
isAnsible := false
if play := yamlContent[playBooks]; play != nil {
if listOfPlayBooks, ok := play.([]interface{}); ok {
for _, value := range listOfPlayBooks {
castingValue, ok := value.(map[string]interface{})
if ok {
for _, keyword := range listKeywordsAnsible {
if _, ok := castingValue[keyword]; ok {
isAnsible = true
}
}
}
}
}
}
return isAnsible
}

// computeValues computes expected Lines of Code to be scanned from locCount channel
Expand Down
32 changes: 22 additions & 10 deletions pkg/analyzer/analyzer_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,11 @@ func TestAnalyzer_Analyze(t *testing.T) {
wantExclude: []string{
filepath.FromSlash("../../test/fixtures/analyzer_test/not_openapi.json"),
filepath.FromSlash("../../test/fixtures/analyzer_test/pnpm-lock.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/dead_symlink")},
filepath.FromSlash("../../test/fixtures/analyzer_test/dead_symlink"),
filepath.FromSlash("../../test/fixtures/analyzer_test/undetected.yaml")},
typesFromFlag: []string{""},
excludeTypesFromFlag: []string{""},
wantLOC: 835,
wantLOC: 834,
wantErr: false,
gitIgnoreFileName: "",
excludeGitIgnore: false,
Expand Down Expand Up @@ -193,11 +194,11 @@ func TestAnalyzer_Analyze(t *testing.T) {
paths: []string{
filepath.FromSlash("../../test/fixtures/analyzer_test/undetected.yaml"),
},
wantTypes: []string{"ansible"},
wantExclude: []string{},
wantTypes: []string{},
wantExclude: []string{filepath.FromSlash("../../test/fixtures/analyzer_test/undetected.yaml")},
typesFromFlag: []string{""},
excludeTypesFromFlag: []string{""},
wantLOC: 1,
wantLOC: 0,
wantErr: false,
gitIgnoreFileName: "",
excludeGitIgnore: false,
Expand All @@ -208,17 +209,26 @@ func TestAnalyzer_Analyze(t *testing.T) {
wantTypes: []string{"ansible", "pulumi"},
wantExclude: []string{
filepath.FromSlash("../../test/fixtures/analyzer_test/azureResourceManager.json"),
filepath.FromSlash("../../test/fixtures/analyzer_test/cloudformation.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/crossplane.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/dead_symlink"),
filepath.FromSlash("../../test/fixtures/analyzer_test/docker-compose.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/gdm.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/helm/Chart.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/helm/templates/service.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/helm/values.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/k8s.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/knative.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/not_openapi.json"),
filepath.FromSlash("../../test/fixtures/analyzer_test/openAPI.json"),
filepath.FromSlash("../../test/fixtures/analyzer_test/openAPI_test/openAPI.json"),
filepath.FromSlash("../../test/fixtures/analyzer_test/openAPI_test/openAPI.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/pnpm-lock.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/dead_symlink")},
filepath.FromSlash("../../test/fixtures/analyzer_test/undetected.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/github.yaml")},
typesFromFlag: []string{"ansible", "pulumi"},
excludeTypesFromFlag: []string{""},
wantLOC: 533,
wantLOC: 374,
wantErr: false,
gitIgnoreFileName: "",
excludeGitIgnore: false,
Expand Down Expand Up @@ -247,10 +257,11 @@ func TestAnalyzer_Analyze(t *testing.T) {
wantExclude: []string{
filepath.FromSlash("../../test/fixtures/analyzer_test/pnpm-lock.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/not_openapi.json"),
filepath.FromSlash("../../test/fixtures/analyzer_test/dead_symlink")},
filepath.FromSlash("../../test/fixtures/analyzer_test/dead_symlink"),
filepath.FromSlash("../../test/fixtures/analyzer_test/undetected.yaml")},
typesFromFlag: []string{""},
excludeTypesFromFlag: []string{""},
wantLOC: 835,
wantLOC: 834,
wantErr: false,
gitIgnoreFileName: "",
excludeGitIgnore: false,
Expand All @@ -263,10 +274,11 @@ func TestAnalyzer_Analyze(t *testing.T) {
filepath.FromSlash("../../test/fixtures/analyzer_test/pnpm-lock.yaml"),
filepath.FromSlash("../../test/fixtures/analyzer_test/not_openapi.json"),
filepath.FromSlash("../../test/fixtures/analyzer_test/dead_symlink"),
filepath.FromSlash("../../test/fixtures/analyzer_test/undetected.yaml"),
},
typesFromFlag: []string{""},
excludeTypesFromFlag: []string{""},
wantLOC: 835,
wantLOC: 834,
wantErr: false,
gitIgnoreFileName: "",
excludeGitIgnore: false,
Expand Down

0 comments on commit 5131c60

Please sign in to comment.