update(uts): kics scan coverage improved

pkg/scan/scan_test.go

@@ -1,14 +1,72 @@
 package scan
 
 import (
-	"path/filepath"
-	"testing"
-
+	"context"
 	"github.com/Checkmarx/kics/assets"
 	"github.com/Checkmarx/kics/pkg/engine/source"
+	"github.com/Checkmarx/kics/pkg/model"
+	consolePrinter "github.com/Checkmarx/kics/pkg/printer"
+	"github.com/Checkmarx/kics/pkg/progress"
 	"github.com/stretchr/testify/require"
+	"path/filepath"
+	"testing"
 )
 
+func Test_ExecuteScan(t *testing.T) {
+	tests := []struct {
+		name                 string
+		scanParams           Parameters
+		ctx                  context.Context
+		expectedResultsCount int
+		expectedSeverity     model.Severity
+		expectedLine         int
+	}{
+		{
+			name: "test exec scan",
+			scanParams: Parameters{
+				ExcludePaths: []string{
+					"./../../test/fixtures/test_scan_cloudfront_logging_disabled/metadata.json",
+					"./../../test/fixtures/test_scan_cloudfront_logging_disabled/positive_expected_result.tf",
+				},
+				Path:                    []string{"./../../test/fixtures/test_scan_cloudfront_logging_disabled/test/positive1.yaml"},
+				QueriesPath:             []string{"./../../test/fixtures/test_scan_cloudfront_logging_disabled"},
+				PreviewLines:            3,
+				CloudProvider:           []string{"aws"},
+				Platform:                []string{"CloudFormation"},
+				ChangedDefaultQueryPath: true,
+				MaxFileSizeFlag:         100,
+				QueryExecTimeout:        60,
+			},
+			ctx:                  context.Background(),
+			expectedResultsCount: 1,
+			expectedSeverity:     "MEDIUM",
+			expectedLine:         5,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c, err := NewClient(&tt.scanParams, &progress.PbBuilder{}, &consolePrinter.Printer{})
+
+			if err != nil {
+				t.Fatalf(`NewClient failed for path %s with error: %v`, tt.scanParams.Path[0], err)
+			}
+
+			r, err := c.executeScan(tt.ctx)
+
+			if err != nil {
+				t.Fatalf(`ExecuteScan failed for path %s with error: %v`, tt.scanParams.Path[0], err)
+			}
+
+			resultsCount := len(r.Results)
+			require.Equal(t, tt.expectedResultsCount, resultsCount)
+
+			firstResult := &r.Results[0]
+			require.Equal(t, tt.expectedSeverity, firstResult.Severity)
+		})
+	}
+}
+
 func Test_GetSecretsRegexRules(t *testing.T) {
 	tests := []struct {
 		name           string

test/fixtures/test_scan_cloudfront_logging_disabled/metadata.json

@@ -0,0 +1,12 @@
+{
+  "id": "de77cd9f-0e8b-46cc-b4a4-b6b436838642",
+  "queryName": "CloudFront Logging Disabled",
+  "severity": "MEDIUM",
+  "category": "Observability",
+  "descriptionText": "AWS CloudFront distributions should have logging enabled to collect all viewer requests, which means the attribute 'DistributionConfig.Logging' should be defined",
+  "descriptionUrl": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/logging-and-monitoring.html",
+  "platform": "CloudFormation",
+  "descriptionID": "3254d6d0",
+  "cloudProvider": "aws",
+  "cwe": ""
+}

test/fixtures/test_scan_cloudfront_logging_disabled/query.rego

@@ -0,0 +1,25 @@
+package Cx
+
+import data.generic.cloudformation as cf_lib
+import data.generic.common as common_lib
+
+CxPolicy[result] {
+	docs := input.document[i]
+	[path, Resources] := walk(docs)
+	resource := Resources[name]
+	resource.Type == "AWS::CloudFront::Distribution"
+
+	distributionConfig := resource.Properties.DistributionConfig
+	not cf_lib.isCloudFormationFalse(distributionConfig.Enabled)
+	not common_lib.valid_key(distributionConfig, "Logging")
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": resource.Type,
+		"resourceName": cf_lib.get_resource_name(resource, name),
+		"searchKey": sprintf("%s%s.Properties", [cf_lib.getPath(path), name]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": sprintf("Resources.%s.Properties.DistributionConfig.Logging should be defined", [name]),
+		"keyActualValue": sprintf("Resources.%s.Properties.DistributionConfig.Logging is undefined", [name]),
+	}
+}

test/fixtures/test_scan_cloudfront_logging_disabled/test/positive1.yaml

@@ -0,0 +1,27 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Resources:
+  myDistribution1:
+    Type: AWS::CloudFront::Distribution
+    Properties:
+      DefaultCacheBehavior:
+        AllowedMethods:
+        - GET
+        - HEAD
+        - OPTIONS
+        TargetOriginId: myS3Origin
+        ForwardedValues:
+          QueryString: 'false'
+          Cookies:
+            Forward: none
+        TrustedSigners:
+        - 1234567890EX
+        ViewerProtocolPolicy: allow-all
+      DistributionConfig:
+        Origins:
+        - DomainName: mybucket.s3.amazonaws.com
+          Id: myS3Origin
+          S3OriginConfig:
+            OriginAccessIdentity: origin-access-identity/cloudfront/E127EXAMPLE51Z
+        Enabled: 'true'
+        Comment: Some comment
+        DefaultRootObject: index.html

test/fixtures/test_scan_cloudfront_logging_disabled/test/positive_expected_result.json

@@ -0,0 +1,8 @@
+[
+  {
+    "queryName": "CloudFront Logging Disabled",
+    "severity": "MEDIUM",
+    "line": 5,
+    "fileName": "positive1.yaml"
+  }
+]