Merge pull request #6757 from Tohar-orca/fix-exposed-api-key-in-openapi

fix(query): false positive detections in "api_key_exposed" function

assets/libraries/openapi.rego

@@ -226,9 +226,21 @@ get_schema_info(doc, version) = schemaInfo {
 api_key_exposed(doc, version, s) {
 	version == "3.0"
 	doc.components.securitySchemes[s].type == "apiKey"
+	server := doc.servers[_]
+	startswith(server.url, "http://")
+} else {
+	version == "3.0"
+	doc.components.securitySchemes[s].type == "apiKey"
+	not valid_key(doc, "servers")
+} else {
+	version == "2.0"
+	doc.securityDefinitions[s].type == "apiKey"
+	scheme := doc.schemes[_]
+    scheme == "http"
 } else {
 	version == "2.0"
 	doc.securityDefinitions[s].type == "apiKey"
+	not valid_key(doc, "schemes")
 }
 
 check_scheme(doc, schemeKey, scope, version) {

assets/queries/openAPI/general/api_key_exposed_in_global_security/test/negative5.yaml

@@ -0,0 +1,32 @@
+openapi: "3.0.1"
+info:
+  title: "test"
+  version: "1.0"
+servers:
+  - url: "https://@API-GW-ID.execute-api.us-east-1.amazonaws.com/{basePath}"
+    variables:
+      basePath:
+        default: "/api"
+
+paths:
+  /address:
+    get:
+      summary: test
+      description: test
+      responses:
+        '200':
+          description: test
+          content:
+            text/plain:
+              schema:
+                type: string
+
+security:
+  - authorizer: [ ]
+
+components:
+  securitySchemes:
+    authorizer:
+      type: "apiKey"
+      name: "authorization"
+      in: "header"

assets/queries/openAPI/general/api_key_exposed_in_operation_security/test/negative5.yaml

@@ -0,0 +1,32 @@
+openapi: "3.0.1"
+info:
+  title: "test"
+  version: "1.0"
+servers:
+  - url: "https://@API-GW-ID.execute-api.us-east-1.amazonaws.com/{basePath}"
+    variables:
+      basePath:
+        default: "/api"
+
+paths:
+  /address:
+    get:
+      summary: test
+      description: test
+      security:
+        - apiKey1: [ ]
+        - authorizer: [ ]
+      responses:
+        '200':
+          description: test
+          content:
+            text/plain:
+              schema:
+                type: string
+
+components:
+  securitySchemes:
+    authorizer:
+      type: "apiKey"
+      name: "authorization"
+      in: "header"