-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(graph): equals/not_equals_ignore_case operators (solvers) (#3698)
* Add equal/not equal ignore case operators * Add equal/not equal ignore case operators Co-authored-by: egotfried <[email protected]>
- Loading branch information
Showing
14 changed files
with
195 additions
and
37 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
17 changes: 17 additions & 0 deletions
17
checkov/common/checks_infra/solvers/attribute_solvers/equals_ignore_case_attribute_solver.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| from typing import Optional, Any, Dict | ||
|
|
||
| from checkov.common.graph.checks_infra.enums import Operators | ||
| from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver | ||
|
|
||
|
|
||
| class EqualsIgnoreCaseAttributeSolver(BaseAttributeSolver): | ||
| operator = Operators.EQUALS_IGNORE_CASE # noqa: CCE003 # a static attribute | ||
|
|
||
| def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: | ||
| attr_val = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None | ||
| # if this value contains an underendered variable, then we cannot evaluate the check, | ||
| # so return True (since we cannot return UNKNOWN) | ||
| # handle edge cases in some policies that explicitly look for blank values | ||
| if self.value != '' and self._is_variable_dependant(attr_val, vertex['source_']): | ||
| return True | ||
| return str(attr_val).lower() == str(self.value).lower() |
11 changes: 11 additions & 0 deletions
11
.../common/checks_infra/solvers/attribute_solvers/not_equals_ignore_case_attribute_solver.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| from typing import Optional, Any, Dict | ||
|
|
||
| from checkov.common.graph.checks_infra.enums import Operators | ||
| from .equals_ignore_case_attribute_solver import EqualsIgnoreCaseAttributeSolver | ||
|
|
||
|
|
||
| class NotEqualsIgnoreCaseAttributeSolver(EqualsIgnoreCaseAttributeSolver): | ||
| operator = Operators.NOT_EQUALS_IGNORE_CASE # noqa: CCE003 # a static attribute | ||
|
|
||
| def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: | ||
| return not super()._get_operation(vertex, attribute) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
12 changes: 12 additions & 0 deletions
12
...rraform/graph/checks_infra/attribute_solvers/equals_ignore_case_solver/BooleanString.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| metadata: | ||
| id: "BooleanString" | ||
| scope: | ||
| provider: "Azure" | ||
| definition: | ||
| cond_type: "attribute" | ||
| resource_types: | ||
| - "azurerm_storage_account" | ||
| attribute: "allow_blob_public_access" | ||
| operator: "equals_ignore_case" | ||
| value: "TRUE" | ||
|
|
14 changes: 14 additions & 0 deletions
14
...rm/graph/checks_infra/attribute_solvers/equals_ignore_case_solver/EncryptedResources.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| metadata: | ||
| id: "EncryptedResources" | ||
| scope: | ||
| provider: "AWS" | ||
| definition: | ||
| cond_type: "attribute" | ||
| resource_types: | ||
| - "aws_rds_cluster" | ||
| - "aws_neptune_cluster" | ||
| - "aws_s3_bucket" | ||
| attribute: "encryption_" | ||
| operator: "equals_ignore_case" | ||
| value: "encrypted" | ||
|
|
Empty file.
34 changes: 34 additions & 0 deletions
34
...s/terraform/graph/checks_infra/attribute_solvers/equals_ignore_case_solver/test_solver.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| import os | ||
|
|
||
| from tests.terraform.graph.checks_infra.test_base import TestBaseSolver | ||
|
|
||
| TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) | ||
|
|
||
|
|
||
| class TestEqualsIgnoreCaseSolver(TestBaseSolver): | ||
| def setUp(self): | ||
| self.checks_dir = TEST_DIRNAME | ||
| super(TestEqualsIgnoreCaseSolver, self).setUp() | ||
|
|
||
| def test_equals_ignore_case_solver_wildcard(self): | ||
| root_folder = '../../../resources/encryption_test' | ||
| check_id = "EncryptedResources" | ||
| should_pass = ['aws_rds_cluster.rds_cluster_encrypted', 'aws_s3_bucket.encrypted_bucket', | ||
| 'aws_neptune_cluster.encrypted_neptune'] | ||
| should_fail = ['aws_rds_cluster.rds_cluster_unencrypted', 'aws_s3_bucket.unencrypted_bucket', | ||
| 'aws_neptune_cluster.unencrypted_neptune'] | ||
| expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} | ||
|
|
||
| super(TestEqualsIgnoreCaseSolver, self).run_test(root_folder=root_folder, expected_results=expected_results, | ||
| check_id=check_id) | ||
|
|
||
| def test_equals_ignore_case_solver_boolean(self): | ||
| root_folder = '../../../resources/boolean_test' | ||
| check_id = "BooleanString" | ||
| should_pass = ['azurerm_storage_account.fail1', 'azurerm_storage_account.fail2', | ||
| 'azurerm_storage_account.fail3'] | ||
| should_fail = ['azurerm_storage_account.pass1', 'azurerm_storage_account.pass2'] | ||
| expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} | ||
|
|
||
| super(TestEqualsIgnoreCaseSolver, self).run_test(root_folder=root_folder, expected_results=expected_results, | ||
| check_id=check_id) |
12 changes: 12 additions & 0 deletions
12
...orm/graph/checks_infra/attribute_solvers/not_equals_ignore_case_solver/BooleanString.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| metadata: | ||
| id: "BooleanString" | ||
| scope: | ||
| provider: "Azure" | ||
| definition: | ||
| cond_type: "attribute" | ||
| resource_types: | ||
| - "azurerm_storage_account" | ||
| attribute: "allow_blob_public_access" | ||
| operator: "not_equals_ignore_case" | ||
| value: "FALSE" | ||
|
|
14 changes: 14 additions & 0 deletions
14
...raph/checks_infra/attribute_solvers/not_equals_ignore_case_solver/EncryptedResources.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| metadata: | ||
| id: "EncryptedResources" | ||
| scope: | ||
| provider: "AWS" | ||
| definition: | ||
| cond_type: "attribute" | ||
| resource_types: | ||
| - "aws_rds_cluster" | ||
| - "aws_neptune_cluster" | ||
| - "aws_s3_bucket" | ||
| attribute: "encryption_" | ||
| operator: "not_equals_ignore_case" | ||
| value: "unencrypted" | ||
|
|
Empty file.
34 changes: 34 additions & 0 deletions
34
...rraform/graph/checks_infra/attribute_solvers/not_equals_ignore_case_solver/test_solver.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| import os | ||
|
|
||
| from tests.terraform.graph.checks_infra.test_base import TestBaseSolver | ||
|
|
||
| TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) | ||
|
|
||
|
|
||
| class TestNotEqualsIgnoreCaseSolver(TestBaseSolver): | ||
| def setUp(self): | ||
| self.checks_dir = TEST_DIRNAME | ||
| super(TestNotEqualsIgnoreCaseSolver, self).setUp() | ||
|
|
||
| def test_not_equals_ignore_case_solver_wildcard(self): | ||
| root_folder = '../../../resources/encryption_test' | ||
| check_id = "EncryptedResources" | ||
| should_pass = ['aws_rds_cluster.rds_cluster_encrypted', 'aws_s3_bucket.encrypted_bucket', | ||
| 'aws_neptune_cluster.encrypted_neptune'] | ||
| should_fail = ['aws_rds_cluster.rds_cluster_unencrypted', 'aws_s3_bucket.unencrypted_bucket', | ||
| 'aws_neptune_cluster.unencrypted_neptune'] | ||
| expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} | ||
|
|
||
| super(TestNotEqualsIgnoreCaseSolver, self).run_test(root_folder=root_folder, expected_results=expected_results, | ||
| check_id=check_id) | ||
|
|
||
| def test_not_equals_ignore_case_solver_boolean(self): | ||
| root_folder = '../../../resources/boolean_test' | ||
| check_id = "BooleanString" | ||
| should_pass = ['azurerm_storage_account.fail1', 'azurerm_storage_account.fail2', | ||
| 'azurerm_storage_account.fail3'] | ||
| should_fail = ['azurerm_storage_account.pass1', 'azurerm_storage_account.pass2'] | ||
| expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} | ||
|
|
||
| super(TestNotEqualsIgnoreCaseSolver, self).run_test(root_folder=root_folder, expected_results=expected_results, | ||
| check_id=check_id) |