From 73c55fe253f130ce4d973d744f0801ef07d80aa8 Mon Sep 17 00:00:00 2001
From: Vlad Klokun <vklokun@protonmail.ch>
Date: Tue, 20 Dec 2022 17:13:03 +0200
Subject: [PATCH] fix: revert the overriden ScanningTarget when submitting
 reports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Before this change, we used to override a scan info `ScanningTarget` to
submit a result that is compatible with the backend for Kubescape.
However, previously we forgot to change back to the original value.

When printing scan results, if the correct order of events (Print →
Score → Submit) was not enforced, this broke the SARIF printer so that
it did not output results due to incorrect `basePath` for the results.

This change reverts to the original `ScanningTarget` value after
submitting the results and fixes the SARIF printer.
---
 .../reporter/v2/reporteventreceiver.go        | 12 ++++-
 .../reporter/v2/reporteventreceiver_test.go   | 47 +++++++++++++++++++
 2 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/core/pkg/resultshandling/reporter/v2/reporteventreceiver.go b/core/pkg/resultshandling/reporter/v2/reporteventreceiver.go
index eb08980b..e1011058 100644
--- a/core/pkg/resultshandling/reporter/v2/reporteventreceiver.go
+++ b/core/pkg/resultshandling/reporter/v2/reporteventreceiver.go
@@ -85,10 +85,18 @@ func (report *ReportEventReceiver) SetClusterName(clusterName string) {
 }
 
 func (report *ReportEventReceiver) prepareReport(opaSessionObj *cautils.OPASessionObj) error {
-	// All scans whose target is not a cluster, currently their target is a file, which is what the backend expects
-	// (e.g. local-git, directory, etc)
+	// The backend for Kubescape expects scanning targets to be either
+	// Clusters or Files, not other types we support (GitLocal, Directory
+	// etc). So, to submit a compatible report to the backend, we have to
+	// override the scanning target, submit the report and then restore the
+	// original value.
+	originalScanningTarget := opaSessionObj.Metadata.ScanMetadata.ScanningTarget
+
 	if opaSessionObj.Metadata.ScanMetadata.ScanningTarget != reporthandlingv2.Cluster {
 		opaSessionObj.Metadata.ScanMetadata.ScanningTarget = reporthandlingv2.File
+		defer func() {
+			opaSessionObj.Metadata.ScanMetadata.ScanningTarget = originalScanningTarget
+		}()
 	}
 
 	report.initEventReceiverURL()
diff --git a/core/pkg/resultshandling/reporter/v2/reporteventreceiver_test.go b/core/pkg/resultshandling/reporter/v2/reporteventreceiver_test.go
index 4f932fa4..18867a51 100644
--- a/core/pkg/resultshandling/reporter/v2/reporteventreceiver_test.go
+++ b/core/pkg/resultshandling/reporter/v2/reporteventreceiver_test.go
@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/kubescape/kubescape/v2/core/cautils"
+	reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -106,3 +107,49 @@ func TestGetURL(t *testing.T) {
 		assert.Equal(t, "https://cloud.armosec.io/account/sign-up?customerGUID=1234&invitationToken=token&utm_campaign=Submit&utm_medium=CLI&utm_source=GitHub", reporter.GetURL())
 	}
 }
+
+func Test_prepareReportKeepsOriginalScanningTarget(t *testing.T) {
+
+	// prepareReport should keep the original scanning target it received, and not mutate it
+	testCases := []struct {
+		Name string
+		Want reporthandlingv2.ScanningTarget
+	}{
+		{"Cluster", reporthandlingv2.Cluster},
+		{"File", reporthandlingv2.File},
+		{"Repo", reporthandlingv2.Repo},
+		{"GitLocal", reporthandlingv2.GitLocal},
+		{"Directory", reporthandlingv2.Directory},
+	}
+
+	reporter := NewReportEventReceiver(
+		&cautils.ConfigObj{
+			AccountID:   "1e3ae7c4-a8bb-4d7c-9bdf-eb86bc25e6bb",
+			Token:       "token",
+			ClusterName: "test",
+		},
+		"",
+		SubmitContextScan,
+	)
+
+	for _, tc := range testCases {
+		t.Run(tc.Name, func(t *testing.T) {
+			want := tc.Want
+
+			opaSessionObj := &cautils.OPASessionObj{
+				Report: &reporthandlingv2.PostureReport{},
+				Metadata: &reporthandlingv2.Metadata{
+					ScanMetadata: reporthandlingv2.ScanMetadata{ScanningTarget: want},
+				},
+			}
+
+			reporter.prepareReport(opaSessionObj)
+
+			got := opaSessionObj.Metadata.ScanMetadata.ScanningTarget
+			if got != want {
+				t.Errorf("Scanning targets don’t match after preparing report. Got: %v, want %v", got, want)
+			}
+		},
+		)
+	}
+}