Skip to content

Commit

Permalink
BREAKING(misconf): Deprecate EXCEPTIONS for misconfiguration scanning
Browse files Browse the repository at this point in the history
  • Loading branch information
@simar7
simar7 committed Oct 22, 2024
1 parent 9514148 commit 812c84a
Show file tree
Hide file tree
Showing 13 changed files with 44 additions and 93 deletions.
3 changes: 0 additions & 3 deletions pkg/cache/mock_artifact_cache.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 0 additions & 2 deletions pkg/compliance/spec/mapper.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,6 @@ func misconfigSummary(misconfig types.DetectedMisconfiguration) *types.MisconfSu
rms.Successes = 1
case types.MisconfStatusFailure:
rms.Failures = 1
case types.MisconfStatusException:
rms.Exceptions = 1
}
return &rms
}
Expand Down
10 changes: 4 additions & 6 deletions pkg/compliance/spec/mapper_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -61,9 +61,8 @@ func TestMapSpecCheckIDToFilteredResults(t *testing.T) {
Class: types.ClassConfig,
Type: ftypes.Kubernetes,
MisconfSummary: &types.MisconfSummary{
Successes: 0,
Failures: 1,
Exceptions: 0,
Successes: 0,
Failures: 1,
},
Misconfigurations: []types.DetectedMisconfiguration{
{
Expand All @@ -79,9 +78,8 @@ func TestMapSpecCheckIDToFilteredResults(t *testing.T) {
Class: types.ClassConfig,
Type: ftypes.Kubernetes,
MisconfSummary: &types.MisconfSummary{
Successes: 0,
Failures: 1,
Exceptions: 0,
Successes: 0,
Failures: 1,
},
Misconfigurations: []types.DetectedMisconfiguration{
{
Expand Down
14 changes: 6 additions & 8 deletions pkg/fanal/types/misconf.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,13 +8,12 @@ import (
)

type Misconfiguration struct {
FileType ConfigType `json:",omitempty"`
FilePath string `json:",omitempty"`
Successes MisconfResults `json:",omitempty"`
Warnings MisconfResults `json:",omitempty"`
Failures MisconfResults `json:",omitempty"`
Exceptions MisconfResults `json:",omitempty"`
Layer Layer `json:",omitempty"`
FileType ConfigType `json:",omitempty"`
FilePath string `json:",omitempty"`
Successes MisconfResults `json:",omitempty"`
Warnings MisconfResults `json:",omitempty"`
Failures MisconfResults `json:",omitempty"`
Layer Layer `json:",omitempty"`
}

type MisconfResult struct {
Expand Down Expand Up @@ -117,7 +116,6 @@ func ToMisconfigurations(misconfs map[string]Misconfiguration) []Misconfiguratio
sort.Sort(misconf.Successes)
sort.Sort(misconf.Warnings)
sort.Sort(misconf.Failures)
sort.Sort(misconf.Exceptions)

results = append(results, misconf)
}
Expand Down
2 changes: 0 additions & 2 deletions pkg/misconf/scanner.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -488,8 +488,6 @@ func ResultsToMisconf(configType types.ConfigType, scannerName string, results s
switch flattened.Status {
case scan.StatusPassed:
misconf.Successes = append(misconf.Successes, misconfResult)
case scan.StatusIgnored:
misconf.Exceptions = append(misconf.Exceptions, misconfResult)
case scan.StatusFailed:
misconf.Failures = append(misconf.Failures, misconfResult)
}
Expand Down
4 changes: 2 additions & 2 deletions pkg/report/table/misconfig.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -61,8 +61,8 @@ func (r *misconfigRenderer) Render() string {
total, summaries := summarize(r.severities, r.countSeverities())

summary := r.result.MisconfSummary
r.printf("Tests: %d (SUCCESSES: %d, FAILURES: %d, EXCEPTIONS: %d)\n",
summary.Successes+summary.Failures+summary.Exceptions, summary.Successes, summary.Failures, summary.Exceptions)
r.printf("Tests: %d (SUCCESSES: %d, FAILURES: %d)\n",
summary.Successes+summary.Failures, summary.Successes, summary.Failures)
r.printf("Failures: %d (%s)\n\n", total, strings.Join(summaries, ", "))

for _, m := range r.result.Misconfigurations {
Expand Down
19 changes: 9 additions & 10 deletions pkg/report/table/misconfig_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ func TestMisconfigRenderer(t *testing.T) {
name: "single result",
input: types.Result{
Target: "my-file",
MisconfSummary: &types.MisconfSummary{Successes: 0, Failures: 1, Exceptions: 0},
MisconfSummary: &types.MisconfSummary{Successes: 0, Failures: 1},
Misconfigurations: []types.DetectedMisconfiguration{
{
ID: "AVD-XYZ-0123",
Expand All @@ -41,7 +41,7 @@ func TestMisconfigRenderer(t *testing.T) {
want: `
my-file ()
==========
Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
HIGH: Oh no, a bad config.
Expand All @@ -58,7 +58,7 @@ See https://google.com/search?q=bad%20config
name: "single result with code",
input: types.Result{
Target: "my-file",
MisconfSummary: &types.MisconfSummary{Successes: 0, Failures: 1, Exceptions: 0},
MisconfSummary: &types.MisconfSummary{Successes: 0, Failures: 1},
Misconfigurations: []types.DetectedMisconfiguration{
{
ID: "AVD-XYZ-0123",
Expand Down Expand Up @@ -100,7 +100,7 @@ See https://google.com/search?q=bad%20config
want: `
my-file ()
==========
Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
HIGH: Oh no, a bad config.
Expand All @@ -123,7 +123,7 @@ See https://google.com/search?q=bad%20config
name: "multiple results",
input: types.Result{
Target: "my-file",
MisconfSummary: &types.MisconfSummary{Successes: 1, Failures: 1, Exceptions: 0},
MisconfSummary: &types.MisconfSummary{Successes: 1, Failures: 1},
Misconfigurations: []types.DetectedMisconfiguration{
{
ID: "AVD-XYZ-0123",
Expand Down Expand Up @@ -171,7 +171,7 @@ See https://google.com/search?q=bad%20config
want: `
my-file ()
==========
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Tests: 2 (SUCCESSES: 1, FAILURES: 1)
Failures: 1 (LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
FAIL: HIGH: Oh no, a bad config.
Expand Down Expand Up @@ -205,9 +205,8 @@ See https://google.com/search?q=bad%20config
Class: types.ClassConfig,
Type: "terraform",
MisconfSummary: &types.MisconfSummary{
Successes: 5,
Failures: 1,
Exceptions: 0,
Successes: 5,
Failures: 1,
},
Misconfigurations: []types.DetectedMisconfiguration{
{
Expand Down Expand Up @@ -309,7 +308,7 @@ See https://google.com/search?q=bad%20config
want: `
terraform-aws-modules/security-group/aws/main.tf (terraform)
============================================================
Tests: 6 (SUCCESSES: 5, FAILURES: 1, EXCEPTIONS: 0)
Tests: 6 (SUCCESSES: 5, FAILURES: 1)
Failures: 1 (LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)
CRITICAL: Security group rule allows ingress from public internet.
Expand Down
6 changes: 1 addition & 5 deletions pkg/result/filter.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -130,13 +130,12 @@ func filterMisconfigurations(result *types.Result, severities []string, includeN

// Filter by ignore file
if f := ignoreConfig.MatchMisconfiguration(misconf.ID, misconf.AVDID, result.Target); f != nil {
result.MisconfSummary.Exceptions++
result.ModifiedFindings = append(result.ModifiedFindings,
types.NewModifiedFinding(misconf, types.FindingStatusIgnored, f.Statement, ignoreConfig.FilePath))
continue
}

// Count successes, failures, and exceptions
// Count successes and failures
summarize(misconf.Status, result.MisconfSummary)

if misconf.Status != types.MisconfStatusFailure && !includeNonFailures {
Expand Down Expand Up @@ -210,8 +209,6 @@ func summarize(status types.MisconfStatus, summary *types.MisconfSummary) {
summary.Failures++
case types.MisconfStatusPassed:
summary.Successes++
case types.MisconfStatusException:
summary.Exceptions++
}
}

Expand Down Expand Up @@ -256,7 +253,6 @@ func applyPolicy(ctx context.Context, result *types.Result, policyFile string) e
return err
}
if ignored {
result.MisconfSummary.Exceptions++
switch misconf.Status {
case types.MisconfStatusFailure:
result.MisconfSummary.Failures--
Expand Down
20 changes: 8 additions & 12 deletions pkg/result/filter_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -233,9 +233,8 @@ func TestFilter(t *testing.T) {
vuln2,
},
MisconfSummary: &types.MisconfSummary{
Successes: 0,
Failures: 1,
Exceptions: 0,
Successes: 0,
Failures: 1,
},
Misconfigurations: []types.DetectedMisconfiguration{
misconf1,
Expand Down Expand Up @@ -403,9 +402,8 @@ func TestFilter(t *testing.T) {
Target: "deployment.yaml",
Class: types.ClassConfig,
MisconfSummary: &types.MisconfSummary{
Successes: 1,
Failures: 1,
Exceptions: 1,
Successes: 1,
Failures: 1,
},
Misconfigurations: []types.DetectedMisconfiguration{
misconf1,
Expand Down Expand Up @@ -522,9 +520,8 @@ func TestFilter(t *testing.T) {
{
Target: "app/Dockerfile",
MisconfSummary: &types.MisconfSummary{
Successes: 0,
Failures: 1,
Exceptions: 2,
Successes: 0,
Failures: 1,
},
Misconfigurations: []types.DetectedMisconfiguration{
misconf3,
Expand Down Expand Up @@ -641,9 +638,8 @@ func TestFilter(t *testing.T) {
Results: types.Results{
{
MisconfSummary: &types.MisconfSummary{
Successes: 1,
Failures: 1,
Exceptions: 1,
Successes: 1,
Failures: 1,
},
Misconfigurations: []types.DetectedMisconfiguration{
misconf1,
Expand Down
24 changes: 11 additions & 13 deletions pkg/rpc/convert.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -754,13 +754,12 @@ func ConvertFromRPCMisconfigurations(rpcMisconfs []*common.Misconfiguration) []f
var misconfs []ftypes.Misconfiguration
for _, rpcMisconf := range rpcMisconfs {
misconfs = append(misconfs, ftypes.Misconfiguration{
FileType: ftypes.ConfigType(rpcMisconf.FileType),
FilePath: rpcMisconf.FilePath,
Successes: ConvertFromRPCMisconfResults(rpcMisconf.Successes),
Warnings: ConvertFromRPCMisconfResults(rpcMisconf.Warnings),
Failures: ConvertFromRPCMisconfResults(rpcMisconf.Failures),
Exceptions: ConvertFromRPCMisconfResults(rpcMisconf.Exceptions),
Layer: ftypes.Layer{},
FileType: ftypes.ConfigType(rpcMisconf.FileType),
FilePath: rpcMisconf.FilePath,
Successes: ConvertFromRPCMisconfResults(rpcMisconf.Successes),
Warnings: ConvertFromRPCMisconfResults(rpcMisconf.Warnings),
Failures: ConvertFromRPCMisconfResults(rpcMisconf.Failures),
Layer: ftypes.Layer{},
})
}
return misconfs
Expand Down Expand Up @@ -875,12 +874,11 @@ func ConvertToRPCPutBlobRequest(diffID string, blobInfo ftypes.BlobInfo) *cache.
var misconfigurations []*common.Misconfiguration
for _, m := range blobInfo.Misconfigurations {
misconfigurations = append(misconfigurations, &common.Misconfiguration{
FileType: string(m.FileType),
FilePath: m.FilePath,
Successes: ConvertToMisconfResults(m.Successes),
Warnings: ConvertToMisconfResults(m.Warnings),
Failures: ConvertToMisconfResults(m.Failures),
Exceptions: ConvertToMisconfResults(m.Exceptions),
FileType: string(m.FileType),
FilePath: m.FilePath,
Successes: ConvertToMisconfResults(m.Successes),
Warnings: ConvertToMisconfResults(m.Warnings),
Failures: ConvertToMisconfResults(m.Failures),
})

}
Expand Down
3 changes: 0 additions & 3 deletions pkg/scanner/local/scan.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -210,9 +210,6 @@ func (s Scanner) MisconfsToResults(misconfs []ftypes.Misconfiguration) types.Res
for _, w := range misconf.Successes {
detected = append(detected, toDetectedMisconfiguration(w, dbTypes.SeverityUnknown, types.MisconfStatusPassed, misconf.Layer))
}
for _, w := range misconf.Exceptions {
detected = append(detected, toDetectedMisconfiguration(w, dbTypes.SeverityUnknown, types.MisconfStatusException, misconf.Layer))
}

results = append(results, types.Result{
Target: misconf.FilePath,
Expand Down
23 changes: 0 additions & 23 deletions pkg/scanner/local/scan_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -820,17 +820,6 @@ func TestScanner_Scan(t *testing.T) {
},
},
},
Exceptions: ftypes.MisconfResults{
{
Namespace: "main.kubernetes.id100",
PolicyMetadata: ftypes.PolicyMetadata{
ID: "ID100",
Type: "Kubernetes Security Check",
Title: "Bad Deployment",
Severity: "HIGH",
},
},
},
Layer: ftypes.Layer{
DiffID: "sha256:9922bc15eeefe1637b803ef2106f178152ce19a391f24aec838cbe2e48e73303",
},
Expand Down Expand Up @@ -922,18 +911,6 @@ func TestScanner_Scan(t *testing.T) {
DiffID: "sha256:9922bc15eeefe1637b803ef2106f178152ce19a391f24aec838cbe2e48e73303",
},
},
{
Type: "Kubernetes Security Check",
ID: "ID100",
Title: "Bad Deployment",
Message: "No issues found",
Namespace: "main.kubernetes.id100",
Severity: "HIGH",
Status: types.MisconfStatusException,
Layer: ftypes.Layer{
DiffID: "sha256:9922bc15eeefe1637b803ef2106f178152ce19a391f24aec838cbe2e48e73303",
},
},
},
},
},
Expand Down
7 changes: 3 additions & 4 deletions pkg/types/report.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -130,13 +130,12 @@ func (r *Result) IsEmpty() bool {
}

type MisconfSummary struct {
Successes int
Failures int
Exceptions int
Successes int
Failures int
}

func (s MisconfSummary) Empty() bool {
return s.Successes == 0 && s.Failures == 0 && s.Exceptions == 0
return s.Successes == 0 && s.Failures == 0
}

// Failed returns whether the result includes any vulnerabilities, misconfigurations or secrets
Expand Down

0 comments on commit 812c84a

Please sign in to comment.