diff --git a/checkov/common/images/image_referencer.py b/checkov/common/images/image_referencer.py index 52d6bbc7c5c..2314ef7b9e7 100644 --- a/checkov/common/images/image_referencer.py +++ b/checkov/common/images/image_referencer.py @@ -10,6 +10,8 @@ import docker from checkov.common.bridgecrew.vulnerability_scanning.image_scanner import image_scanner +from checkov.common.bridgecrew.vulnerability_scanning.integrations.docker_image_scanning import \ + docker_image_scanning_integration from checkov.common.output.common import ImageDetails from checkov.common.output.report import Report, CheckType from checkov.common.runners.base_runner import strtobool @@ -119,6 +121,7 @@ def check_container_image_references( runner_filter: RunnerFilter, ) -> Report | None: """Tries to find image references in graph based IaC templates""" + from checkov.common.bridgecrew.platform_integration import bc_integration # skip complete run, if flag '--check' was used without a CVE check ID if runner_filter.checks and all(not check.startswith("CKV_CVE") for check in runner_filter.checks): @@ -144,6 +147,7 @@ def check_container_image_references( image=image, runner_filter=runner_filter, report_type=report_type, + bc_integration=bc_integration, ) return report @@ -157,12 +161,21 @@ def add_image_records( image: Image, runner_filter: RunnerFilter, report_type: str, + bc_integration: BcPlatformIntegration, ) -> None: """Adds an image record to the given report, if possible""" cached_results: dict[str, Any] = image_scanner.get_scan_results_from_cache(f"image:{image.name}") if cached_results: logging.info(f"Found cached scan results of image {image.name}") + image_scanning_report: dict[str, Any] = docker_image_scanning_integration.create_report( + twistcli_scan_result=cached_results, + bc_platform_integration=bc_integration, + file_path=dockerfile_path, + file_content=f'image: {image.name}', + docker_image_name=image.name, + related_resource_id=image.related_resource_id) + report.image_cached_results.append(image_scanning_report) result = cached_results.get("results", [{}])[0] image_id = self.extract_image_short_id(result) diff --git a/checkov/terraform/image_referencer/base_provider.py b/checkov/terraform/image_referencer/base_provider.py index f8ba33d9652..5e3f657c7dd 100644 --- a/checkov/terraform/image_referencer/base_provider.py +++ b/checkov/terraform/image_referencer/base_provider.py @@ -1,11 +1,13 @@ from __future__ import annotations +import os from typing import TYPE_CHECKING, Callable, Any from hcl2 import START_LINE, END_LINE from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.images.image_referencer import Image +from checkov.common.util.str_utils import removeprefix if TYPE_CHECKING: from networkx import DiGraph @@ -49,6 +51,7 @@ def extract_images_from_resources(self) -> list[Image]: name=name, start_line=resource[START_LINE], end_line=resource[END_LINE], + related_resource_id=f'{removeprefix(resource.get("file_path_"), os.getenv("BC_ROOT_DIR", ""))}:{resource.get("id_")}' ) ) diff --git a/tests/terraform/image_referencer/provider/test_aws.py b/tests/terraform/image_referencer/provider/test_aws.py index 44ed2a00a99..0ceaa2300a3 100644 --- a/tests/terraform/image_referencer/provider/test_aws.py +++ b/tests/terraform/image_referencer/provider/test_aws.py @@ -43,13 +43,15 @@ def test_extract_images_from_resources(): file_path="/ecs.tf", name="nginx", start_line=1, - end_line=31 + end_line=31, + related_resource_id='/ecs.tf:None' ), Image( file_path="/ecs.tf", name="python:3.9-alpine", start_line=1, - end_line=31 + end_line=31, + related_resource_id='/ecs.tf:None' ), ] diff --git a/tests/terraform/image_referencer/test_manager.py b/tests/terraform/image_referencer/test_manager.py index 59e8c11cef8..5cc8b0ed940 100644 --- a/tests/terraform/image_referencer/test_manager.py +++ b/tests/terraform/image_referencer/test_manager.py @@ -46,6 +46,6 @@ def test_extract_images_from_resources(): # then assert images == [ - Image(file_path="/ecs.tf", name="nginx", start_line=1, end_line=31), - Image(file_path="/batch.tf", name="python:3.9-alpine", start_line=1, end_line=25), + Image(file_path="/ecs.tf", name="nginx", start_line=1, end_line=31, related_resource_id='/ecs.tf:None'), + Image(file_path="/batch.tf", name="python:3.9-alpine", start_line=1, end_line=25, related_resource_id='/batch.tf:None'), ] diff --git a/tests/terraform/image_referencer/test_runner_aws_resources.py b/tests/terraform/image_referencer/test_runner_aws_resources.py index b97a66f1a5f..3f67618a187 100644 --- a/tests/terraform/image_referencer/test_runner_aws_resources.py +++ b/tests/terraform/image_referencer/test_runner_aws_resources.py @@ -1,7 +1,9 @@ +import os from pathlib import Path from pytest_mock import MockerFixture +from checkov.common.bridgecrew.bc_source import get_source_type from checkov.common.output.report import CheckType from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner @@ -10,12 +12,15 @@ def test_apprunner_resources(mocker: MockerFixture, image_cached_result, license_statuses_result): + from checkov.common.bridgecrew.platform_integration import bc_integration + # given file_name = "apprunner.tf" image_name = "public.ecr.aws/aws-containers/hello-app-runner:latest" code_lines = "1-23" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) + bc_integration.bc_source = get_source_type('disabled') mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache", @@ -47,8 +52,17 @@ def test_apprunner_resources(mocker: MockerFixture, image_cached_result, license f"{file_name} ({image_name} lines:{code_lines} (sha256:f9b91f78b0)).openssl", f"{file_name} ({image_name} lines:{code_lines} (sha256:f9b91f78b0)).zlib", } + assert sca_image_report.image_cached_results[0]['dockerImageName'] == \ + 'public.ecr.aws/aws-containers/hello-app-runner:latest' + assert 'terraform/image_referencer/resources/aws/apprunner.tf:aws_apprunner_service.example' in \ + sca_image_report.image_cached_results[0]['relatedResourceId'] + assert sca_image_report.image_cached_results[0]['packages'] == [ + {'type': 'os', 'name': 'zlib', 'version': '1.2.12-r1', 'licenses': ['Zlib']} + ] + assert len(sca_image_report.passed_checks) == 1 assert len(sca_image_report.failed_checks) == 2 + assert len(sca_image_report.image_cached_results) == 1 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0