Skip to content

Commit a4180bd

Browse files
nikpivkinnikpivkin
authoredAug 6, 2024··
fix(misconf): load only submodule if it is specified in source (#7112)
Signed-off-by: nikpivkin <[email protected]>
·
v0.62.0v0.55.0
1 parent c766831 commit a4180bd

File tree

6 files changed

+45
-33
lines changed

6 files changed

+45
-33
lines changed
 

‎pkg/iac/scanners/terraform/parser/resolvers/cache.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ func (r *cacheResolver) Resolve(_ context.Context, _ fs.FS, opt Options) (filesy
5151
return nil, "", "", false, nil
5252
}
5353

54-
src := removeSubdirFromSource(opt.Source)
54+
src, subdir := splitPackageSubdirRaw(opt.Source)
5555
key := cacheKey(src, opt.Version)
5656

5757
opt.Debug("Trying to resolve: %s", key)
@@ -62,7 +62,7 @@ func (r *cacheResolver) Resolve(_ context.Context, _ fs.FS, opt Options) (filesy
6262
return nil, "", "", true, err
6363
}
6464

65-
return os.DirFS(filepath.Join(cacheDir, key)), opt.OriginalSource, ".", true, nil
65+
return os.DirFS(filepath.Join(cacheDir, key)), opt.OriginalSource, subdir, true, nil
6666
}
6767
return nil, "", "", false, nil
6868
}

‎pkg/iac/scanners/terraform/parser/resolvers/cache_integration_test.go

+12-7
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,10 @@ func TestResolveModuleFromCache(t *testing.T) {
2121
}
2222

2323
tests := []struct {
24-
name string
25-
opts resolvers.Options
26-
firstResolver moduleResolver
24+
name string
25+
opts resolvers.Options
26+
firstResolver moduleResolver
27+
expectedSubdir string
2728
}{
2829
{
2930
name: "registry",
@@ -32,7 +33,8 @@ func TestResolveModuleFromCache(t *testing.T) {
3233
Source: "terraform-aws-modules/s3-bucket/aws",
3334
Version: "4.1.2",
3435
},
35-
firstResolver: resolvers.Registry,
36+
firstResolver: resolvers.Registry,
37+
expectedSubdir: ".",
3638
},
3739
{
3840
name: "registry with subdir",
@@ -41,23 +43,26 @@ func TestResolveModuleFromCache(t *testing.T) {
4143
Source: "terraform-aws-modules/s3-bucket/aws//modules/object",
4244
Version: "4.1.2",
4345
},
44-
firstResolver: resolvers.Registry,
46+
firstResolver: resolvers.Registry,
47+
expectedSubdir: "modules/object",
4548
},
4649
{
4750
name: "remote",
4851
opts: resolvers.Options{
4952
Name: "bucket",
5053
Source: "git::https://github.com/terraform-aws-modules/terraform-aws-s3-bucket.git?ref=v4.1.2",
5154
},
52-
firstResolver: resolvers.Remote,
55+
firstResolver: resolvers.Remote,
56+
expectedSubdir: ".",
5357
},
5458
{
5559
name: "remote with subdir",
5660
opts: resolvers.Options{
5761
Name: "object",
5862
Source: "git::https://github.com/terraform-aws-modules/terraform-aws-s3-bucket.git//modules/object?ref=v4.1.2",
5963
},
60-
firstResolver: resolvers.Remote,
64+
firstResolver: resolvers.Remote,
65+
expectedSubdir: "modules/object",
6166
},
6267
}
6368

‎pkg/iac/scanners/terraform/parser/resolvers/registry.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ func (r *registryResolver) Resolve(ctx context.Context, target fs.FS, opt Option
4545
}
4646

4747
inputVersion := opt.Version
48-
source := removeSubdirFromSource(opt.Source)
48+
source, _ := splitPackageSubdirRaw(opt.Source)
4949
parts := strings.Split(source, "/")
5050
if len(parts) < 3 || len(parts) > 4 {
5151
return

‎pkg/iac/scanners/terraform/parser/resolvers/remote.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ func (r *remoteResolver) Resolve(ctx context.Context, _ fs.FS, opt Options) (fil
3838
return nil, "", "", false, nil
3939
}
4040

41-
src := removeSubdirFromSource(opt.OriginalSource)
41+
src, subdir := splitPackageSubdirRaw(opt.OriginalSource)
4242
key := cacheKey(src, opt.OriginalVersion)
4343
opt.Debug("Storing with cache key %s", key)
4444

@@ -54,7 +54,7 @@ func (r *remoteResolver) Resolve(ctx context.Context, _ fs.FS, opt Options) (fil
5454
r.incrementCount(opt)
5555
opt.Debug("Successfully downloaded %s from %s", opt.Name, opt.Source)
5656
opt.Debug("Module '%s' resolved via remote download.", opt.Name)
57-
return os.DirFS(cacheDir), opt.Source, filepath.Join(".", opt.RelativePath), true, nil
57+
return os.DirFS(cacheDir), opt.Source, subdir, true, nil
5858
}
5959

6060
func (r *remoteResolver) download(ctx context.Context, opt Options, dst string) error {

‎pkg/iac/scanners/terraform/parser/resolvers/source.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ package resolvers
22

33
import "strings"
44

5-
func removeSubdirFromSource(src string) string {
5+
func splitPackageSubdirRaw(src string) (string, string) {
66
stop := len(src)
77
if idx := strings.Index(src, "?"); idx > -1 {
88
stop = idx
@@ -18,7 +18,7 @@ func removeSubdirFromSource(src string) string {
1818
// First see if we even have an explicit subdir
1919
idx := strings.Index(src[offset:stop], "//")
2020
if idx == -1 {
21-
return src
21+
return src, "."
2222
}
2323

2424
idx += offset
@@ -29,8 +29,9 @@ func removeSubdirFromSource(src string) string {
2929
// URL.
3030
if idx = strings.Index(subdir, "?"); idx > -1 {
3131
query := subdir[idx:]
32+
subdir = subdir[:idx]
3233
src += query
3334
}
3435

35-
return src
36+
return src, subdir
3637
}

‎pkg/iac/scanners/terraform/parser/resolvers/source_test.go

+24-18
Original file line numberDiff line numberDiff line change
@@ -6,39 +6,45 @@ import (
66
"github.com/stretchr/testify/assert"
77
)
88

9-
func TestRemoveSubdirFromSource(t *testing.T) {
9+
func TestSplitPackageSubdirRaw(t *testing.T) {
1010

1111
tests := []struct {
12-
name string
13-
source string
14-
expected string
12+
name string
13+
source string
14+
expectedPkg string
15+
expectedSubdir string
1516
}{
1617
{
17-
name: "address with scheme and query string",
18-
source: "git::https://github.com/aquasecurity/terraform-modules.git//modules/ecs-service?ref=v0.1.0",
19-
expected: "git::https://github.com/aquasecurity/terraform-modules.git?ref=v0.1.0",
18+
name: "address with scheme and query string",
19+
source: "git::https://github.com/aquasecurity/terraform-modules.git//modules/ecs-service?ref=v0.1.0",
20+
expectedPkg: "git::https://github.com/aquasecurity/terraform-modules.git?ref=v0.1.0",
21+
expectedSubdir: "modules/ecs-service",
2022
},
2123
{
22-
name: "address with scheme",
23-
source: "git::https://github.com/aquasecurity/terraform-modules.git//modules/ecs-service",
24-
expected: "git::https://github.com/aquasecurity/terraform-modules.git",
24+
name: "address with scheme",
25+
source: "git::https://github.com/aquasecurity/terraform-modules.git//modules/ecs-service",
26+
expectedPkg: "git::https://github.com/aquasecurity/terraform-modules.git",
27+
expectedSubdir: "modules/ecs-service",
2528
},
2629
{
27-
name: "registry address",
28-
source: "hashicorp/consul/aws//modules/consul-cluster",
29-
expected: "hashicorp/consul/aws",
30+
name: "registry address",
31+
source: "hashicorp/consul/aws//modules/consul-cluster",
32+
expectedPkg: "hashicorp/consul/aws",
33+
expectedSubdir: "modules/consul-cluster",
3034
},
3135
{
32-
name: "without subdir",
33-
source: `hashicorp/consul/aws`,
34-
expected: `hashicorp/consul/aws`,
36+
name: "without subdir",
37+
source: `hashicorp/consul/aws`,
38+
expectedPkg: `hashicorp/consul/aws`,
39+
expectedSubdir: ".",
3540
},
3641
}
3742

3843
for _, test := range tests {
3944
t.Run(test.name, func(t *testing.T) {
40-
got := removeSubdirFromSource(test.source)
41-
assert.Equal(t, test.expected, got)
45+
pkgAddr, subdir := splitPackageSubdirRaw(test.source)
46+
assert.Equal(t, test.expectedPkg, pkgAddr)
47+
assert.Equal(t, test.expectedSubdir, subdir)
4248
})
4349
}
4450
}

0 commit comments

Comments
 (0)
Please sign in to comment.