github/kubescape
1
0
Fork 0
mirror of https://github.com/kubescape/kubescape.git synced 2026-04-15 06:58:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1487 from cbrom/core_cautils_datastructuremethods_tests

Browse Source 
Adding Tests and Refactoring for ruleWithKSOpaDependency Function in cautils
This commit is contained in:
Matthias Bertschy
2023-11-22 17:21:17 +01:00
committed by GitHub
parent 8cacd4d984 4ae45cd727
commit dc6c379aa2
2 changed files with 21 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/cautils/datastructuresmethods.go
+11 -14
View File
@@ -3,7 +3,6 @@ package cautils
import (
"golang.org/x/mod/semver"
"github.com/armosec/utils-go/boolutils"
"github.com/kubescape/opa-utils/reporthandling"
"github.com/kubescape/opa-utils/reporthandling/apis"
)
@@ -33,7 +32,7 @@ func (policies *Policies) Set(frameworks []reporthandling.Framework, version str
}
}
if !ruleWithKSOpaDependency(frameworks[i].Controls[j].Rules[r].Attributes) && isRuleKubescapeVersionCompatible(frameworks[i].Controls[j].Rules[r].Attributes, version) && isControlFitToScanScope(frameworks[i].Controls[j], scanningScope) {
if isRuleKubescapeVersionCompatible(frameworks[i].Controls[j].Rules[r].Attributes, version) && isControlFitToScanScope(frameworks[i].Controls[j], scanningScope) {
compatibleRules = append(compatibleRules, frameworks[i].Controls[j].Rules[r])
}
}
@@ -55,23 +54,17 @@ func (policies *Policies) Set(frameworks []reporthandling.Framework, version str
}
}
func ruleWithKSOpaDependency(attributes map[string]interface{}) bool {
if attributes == nil {
return false
}
if s, ok := attributes["armoOpa"]; ok { // TODO - make global
return boolutils.StringToBool(s.(string))
}
return false
}
// Checks that kubescape version is in range of use for this rule
// In local build (BuildNumber = ""):
// returns true only if rule doesn't have the "until" attribute
func isRuleKubescapeVersionCompatible(attributes map[string]interface{}, version string) bool {
if from, ok := attributes["useFromKubescapeVersion"]; ok && from != nil {
if version != "" {
if semver.Compare(version, from.(string)) == -1 {
if sfrom, ok := from.(string); ok {
if semver.Compare(version, sfrom) == -1 {
return false
}
} else {
return false
}
}
@@ -80,7 +73,11 @@ func isRuleKubescapeVersionCompatible(attributes map[string]interface{}, version
if version == "" {
return false
}
if semver.Compare(version, until.(string)) >= 0 {
if suntil, ok := until.(string); ok {
if semver.Compare(version, suntil) >= 0 {
return false
}
} else {
return false
}
}
core/cautils/versioncheck_test.go
+10 -1
View File
@@ -20,11 +20,20 @@ var rule_v1_0_133 = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{
Attributes: map[string]interface{}{"useFromKubescapeVersion": "v1.0.133", "useUntilKubescapeVersion": "v1.0.134"}}}
var rule_v1_0_134 = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{
Attributes: map[string]interface{}{"useFromKubescapeVersion": "v1.0.134"}}}
var rule_invalid_from = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{
Attributes: map[string]interface{}{"useFromKubescapeVersion": 1.0135, "useUntilKubescapeVersion": "v1.0.135"}}}
var rule_invalid_until = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{
Attributes: map[string]interface{}{"useFromKubescapeVersion": "v1.0.135", "useUntilKubescapeVersion": 1.0135}}}
func TestIsRuleKubescapeVersionCompatible(t *testing.T) {
// local build- no build number
// should not crash when the value of useUntilKubescapeVersion is not a string
buildNumberMock := "v1.0.135"
assert.False(t, isRuleKubescapeVersionCompatible(rule_invalid_from.Attributes, buildNumberMock))
assert.False(t, isRuleKubescapeVersionCompatible(rule_invalid_from.Attributes, buildNumberMock))
// should use only rules that don't have "until"
buildNumberMock := ""
buildNumberMock = ""
assert.False(t, isRuleKubescapeVersionCompatible(rule_v1_0_131.Attributes, buildNumberMock))
assert.False(t, isRuleKubescapeVersionCompatible(rule_v1_0_132.Attributes, buildNumberMock))
assert.False(t, isRuleKubescapeVersionCompatible(rule_v1_0_133.Attributes, buildNumberMock))