diff --git a/core/cautils/datastructuresmethods.go b/core/cautils/datastructuresmethods.go index ecacd26f..c9b4b56c 100644 --- a/core/cautils/datastructuresmethods.go +++ b/core/cautils/datastructuresmethods.go @@ -3,7 +3,6 @@ package cautils import ( "golang.org/x/mod/semver" - "github.com/armosec/utils-go/boolutils" "github.com/kubescape/opa-utils/reporthandling" "github.com/kubescape/opa-utils/reporthandling/apis" ) @@ -33,7 +32,7 @@ func (policies *Policies) Set(frameworks []reporthandling.Framework, version str } } - if !ruleWithKSOpaDependency(frameworks[i].Controls[j].Rules[r].Attributes) && isRuleKubescapeVersionCompatible(frameworks[i].Controls[j].Rules[r].Attributes, version) && isControlFitToScanScope(frameworks[i].Controls[j], scanningScope) { + if isRuleKubescapeVersionCompatible(frameworks[i].Controls[j].Rules[r].Attributes, version) && isControlFitToScanScope(frameworks[i].Controls[j], scanningScope) { compatibleRules = append(compatibleRules, frameworks[i].Controls[j].Rules[r]) } } @@ -55,23 +54,17 @@ func (policies *Policies) Set(frameworks []reporthandling.Framework, version str } } -func ruleWithKSOpaDependency(attributes map[string]interface{}) bool { - if attributes == nil { - return false - } - if s, ok := attributes["armoOpa"]; ok { // TODO - make global - return boolutils.StringToBool(s.(string)) - } - return false -} - // Checks that kubescape version is in range of use for this rule // In local build (BuildNumber = ""): // returns true only if rule doesn't have the "until" attribute func isRuleKubescapeVersionCompatible(attributes map[string]interface{}, version string) bool { if from, ok := attributes["useFromKubescapeVersion"]; ok && from != nil { if version != "" { - if semver.Compare(version, from.(string)) == -1 { + if sfrom, ok := from.(string); ok { + if semver.Compare(version, sfrom) == -1 { + return false + } + } else { return false } } @@ -80,7 +73,11 @@ func isRuleKubescapeVersionCompatible(attributes map[string]interface{}, version if version == "" { return false } - if semver.Compare(version, until.(string)) >= 0 { + if suntil, ok := until.(string); ok { + if semver.Compare(version, suntil) >= 0 { + return false + } + } else { return false } } diff --git a/core/cautils/versioncheck_test.go b/core/cautils/versioncheck_test.go index 2be10e7e..fa8b5265 100644 --- a/core/cautils/versioncheck_test.go +++ b/core/cautils/versioncheck_test.go @@ -20,11 +20,20 @@ var rule_v1_0_133 = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{ Attributes: map[string]interface{}{"useFromKubescapeVersion": "v1.0.133", "useUntilKubescapeVersion": "v1.0.134"}}} var rule_v1_0_134 = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{ Attributes: map[string]interface{}{"useFromKubescapeVersion": "v1.0.134"}}} +var rule_invalid_from = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{ + Attributes: map[string]interface{}{"useFromKubescapeVersion": 1.0135, "useUntilKubescapeVersion": "v1.0.135"}}} +var rule_invalid_until = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{ + Attributes: map[string]interface{}{"useFromKubescapeVersion": "v1.0.135", "useUntilKubescapeVersion": 1.0135}}} func TestIsRuleKubescapeVersionCompatible(t *testing.T) { // local build- no build number + + // should not crash when the value of useUntilKubescapeVersion is not a string + buildNumberMock := "v1.0.135" + assert.False(t, isRuleKubescapeVersionCompatible(rule_invalid_from.Attributes, buildNumberMock)) + assert.False(t, isRuleKubescapeVersionCompatible(rule_invalid_from.Attributes, buildNumberMock)) // should use only rules that don't have "until" - buildNumberMock := "" + buildNumberMock = "" assert.False(t, isRuleKubescapeVersionCompatible(rule_v1_0_131.Attributes, buildNumberMock)) assert.False(t, isRuleKubescapeVersionCompatible(rule_v1_0_132.Attributes, buildNumberMock)) assert.False(t, isRuleKubescapeVersionCompatible(rule_v1_0_133.Attributes, buildNumberMock))