From 73d1805ce60887e30469595b6c5f4418b6ea1792 Mon Sep 17 00:00:00 2001 From: cbrom Date: Wed, 22 Nov 2023 02:07:19 +0300 Subject: [PATCH 1/5] added tests for ruleWithKSOpaDependency function Signed-off-by: cbrom --- core/cautils/datastructuresmethods.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/core/cautils/datastructuresmethods.go b/core/cautils/datastructuresmethods.go index ecacd26f..86523b84 100644 --- a/core/cautils/datastructuresmethods.go +++ b/core/cautils/datastructuresmethods.go @@ -59,8 +59,10 @@ func ruleWithKSOpaDependency(attributes map[string]interface{}) bool { if attributes == nil { return false } - if s, ok := attributes["armoOpa"]; ok { // TODO - make global - return boolutils.StringToBool(s.(string)) + if val, ok := attributes["armoOpa"]; ok { // TODO - make global + if s, ok := val.(string); ok { + return boolutils.StringToBool(s) + } } return false } From 7eb97fcba0958c7a125958a29ac4c2bd635f59cc Mon Sep 17 00:00:00 2001 From: cbrom Date: Wed, 22 Nov 2023 02:07:36 +0300 Subject: [PATCH 2/5] added tests for ruleWithKSOpaDependency function Signed-off-by: cbrom --- core/cautils/datastructuresmethods_test.go | 31 ++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/core/cautils/datastructuresmethods_test.go b/core/cautils/datastructuresmethods_test.go index 1c02b36e..45f9322a 100644 --- a/core/cautils/datastructuresmethods_test.go +++ b/core/cautils/datastructuresmethods_test.go @@ -9,6 +9,37 @@ import ( "github.com/stretchr/testify/assert" ) +func TestRuleWithKSOpaDependency(t *testing.T) { + t.Run("return false when attributes is nil", func(t *testing.T) { + result := ruleWithKSOpaDependency(nil) + assert.False(t, result) + }) + + t.Run("returns false when attributes does not contain armoOpa key", func(t *testing.T) { + attributes := map[string]interface{}{ + "key": "value", + } + result := ruleWithKSOpaDependency(attributes) + assert.False(t, result) + }) + + t.Run("returns false when attributes contain armoOpa key with non bool value", func(t *testing.T) { + attributes := map[string]interface{}{ + "armoOpa": true, + } + result := ruleWithKSOpaDependency(attributes) + assert.False(t, result) + }) + + t.Run("returns true when attributes contain armoOpa key with value true", func(t *testing.T) { + attributes := map[string]interface{}{ + "armoOpa": "true", + } + result := ruleWithKSOpaDependency(attributes) + assert.True(t, result) + }) +} + func TestIsScanningScopeMatchToControlScope(t *testing.T) { tests := []struct { scanScope reporthandling.ScanningScopeType From d45c97cef0fc77fdcc9729512caf09a447642d1a Mon Sep 17 00:00:00 2001 From: cbrom Date: Wed, 22 Nov 2023 11:24:44 +0300 Subject: [PATCH 3/5] removed ruleWithKSOpaDependency function along with tests Signed-off-by: cbrom --- core/cautils/datastructuresmethods.go | 15 +---------- core/cautils/datastructuresmethods_test.go | 31 ---------------------- 2 files changed, 1 insertion(+), 45 deletions(-) diff --git a/core/cautils/datastructuresmethods.go b/core/cautils/datastructuresmethods.go index 86523b84..0191edf3 100644 --- a/core/cautils/datastructuresmethods.go +++ b/core/cautils/datastructuresmethods.go @@ -3,7 +3,6 @@ package cautils import ( "golang.org/x/mod/semver" - "github.com/armosec/utils-go/boolutils" "github.com/kubescape/opa-utils/reporthandling" "github.com/kubescape/opa-utils/reporthandling/apis" ) @@ -33,7 +32,7 @@ func (policies *Policies) Set(frameworks []reporthandling.Framework, version str } } - if !ruleWithKSOpaDependency(frameworks[i].Controls[j].Rules[r].Attributes) && isRuleKubescapeVersionCompatible(frameworks[i].Controls[j].Rules[r].Attributes, version) && isControlFitToScanScope(frameworks[i].Controls[j], scanningScope) { + if isRuleKubescapeVersionCompatible(frameworks[i].Controls[j].Rules[r].Attributes, version) && isControlFitToScanScope(frameworks[i].Controls[j], scanningScope) { compatibleRules = append(compatibleRules, frameworks[i].Controls[j].Rules[r]) } } @@ -55,18 +54,6 @@ func (policies *Policies) Set(frameworks []reporthandling.Framework, version str } } -func ruleWithKSOpaDependency(attributes map[string]interface{}) bool { - if attributes == nil { - return false - } - if val, ok := attributes["armoOpa"]; ok { // TODO - make global - if s, ok := val.(string); ok { - return boolutils.StringToBool(s) - } - } - return false -} - // Checks that kubescape version is in range of use for this rule // In local build (BuildNumber = ""): // returns true only if rule doesn't have the "until" attribute diff --git a/core/cautils/datastructuresmethods_test.go b/core/cautils/datastructuresmethods_test.go index 45f9322a..1c02b36e 100644 --- a/core/cautils/datastructuresmethods_test.go +++ b/core/cautils/datastructuresmethods_test.go @@ -9,37 +9,6 @@ import ( "github.com/stretchr/testify/assert" ) -func TestRuleWithKSOpaDependency(t *testing.T) { - t.Run("return false when attributes is nil", func(t *testing.T) { - result := ruleWithKSOpaDependency(nil) - assert.False(t, result) - }) - - t.Run("returns false when attributes does not contain armoOpa key", func(t *testing.T) { - attributes := map[string]interface{}{ - "key": "value", - } - result := ruleWithKSOpaDependency(attributes) - assert.False(t, result) - }) - - t.Run("returns false when attributes contain armoOpa key with non bool value", func(t *testing.T) { - attributes := map[string]interface{}{ - "armoOpa": true, - } - result := ruleWithKSOpaDependency(attributes) - assert.False(t, result) - }) - - t.Run("returns true when attributes contain armoOpa key with value true", func(t *testing.T) { - attributes := map[string]interface{}{ - "armoOpa": "true", - } - result := ruleWithKSOpaDependency(attributes) - assert.True(t, result) - }) -} - func TestIsScanningScopeMatchToControlScope(t *testing.T) { tests := []struct { scanScope reporthandling.ScanningScopeType From b0a376aa2bba824cf87845122faffcb62ef69790 Mon Sep 17 00:00:00 2001 From: cbrom Date: Wed, 22 Nov 2023 11:25:29 +0300 Subject: [PATCH 4/5] safe check from and until strings before usage in isRuleKubescapeVersionCompatible function Signed-off-by: cbrom --- core/cautils/datastructuresmethods.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/core/cautils/datastructuresmethods.go b/core/cautils/datastructuresmethods.go index 0191edf3..c9b4b56c 100644 --- a/core/cautils/datastructuresmethods.go +++ b/core/cautils/datastructuresmethods.go @@ -60,7 +60,11 @@ func (policies *Policies) Set(frameworks []reporthandling.Framework, version str func isRuleKubescapeVersionCompatible(attributes map[string]interface{}, version string) bool { if from, ok := attributes["useFromKubescapeVersion"]; ok && from != nil { if version != "" { - if semver.Compare(version, from.(string)) == -1 { + if sfrom, ok := from.(string); ok { + if semver.Compare(version, sfrom) == -1 { + return false + } + } else { return false } } @@ -69,7 +73,11 @@ func isRuleKubescapeVersionCompatible(attributes map[string]interface{}, version if version == "" { return false } - if semver.Compare(version, until.(string)) >= 0 { + if suntil, ok := until.(string); ok { + if semver.Compare(version, suntil) >= 0 { + return false + } + } else { return false } } From 4ae45cd727218206cc4a7fcf7d45afa789b4f3c2 Mon Sep 17 00:00:00 2001 From: cbrom Date: Wed, 22 Nov 2023 11:26:18 +0300 Subject: [PATCH 5/5] added tests for non string values of useUntilKubescapeVersion and useFromKubescapeVersion Signed-off-by: cbrom --- core/cautils/versioncheck_test.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/core/cautils/versioncheck_test.go b/core/cautils/versioncheck_test.go index 2be10e7e..fa8b5265 100644 --- a/core/cautils/versioncheck_test.go +++ b/core/cautils/versioncheck_test.go @@ -20,11 +20,20 @@ var rule_v1_0_133 = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{ Attributes: map[string]interface{}{"useFromKubescapeVersion": "v1.0.133", "useUntilKubescapeVersion": "v1.0.134"}}} var rule_v1_0_134 = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{ Attributes: map[string]interface{}{"useFromKubescapeVersion": "v1.0.134"}}} +var rule_invalid_from = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{ + Attributes: map[string]interface{}{"useFromKubescapeVersion": 1.0135, "useUntilKubescapeVersion": "v1.0.135"}}} +var rule_invalid_until = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{ + Attributes: map[string]interface{}{"useFromKubescapeVersion": "v1.0.135", "useUntilKubescapeVersion": 1.0135}}} func TestIsRuleKubescapeVersionCompatible(t *testing.T) { // local build- no build number + + // should not crash when the value of useUntilKubescapeVersion is not a string + buildNumberMock := "v1.0.135" + assert.False(t, isRuleKubescapeVersionCompatible(rule_invalid_from.Attributes, buildNumberMock)) + assert.False(t, isRuleKubescapeVersionCompatible(rule_invalid_from.Attributes, buildNumberMock)) // should use only rules that don't have "until" - buildNumberMock := "" + buildNumberMock = "" assert.False(t, isRuleKubescapeVersionCompatible(rule_v1_0_131.Attributes, buildNumberMock)) assert.False(t, isRuleKubescapeVersionCompatible(rule_v1_0_132.Attributes, buildNumberMock)) assert.False(t, isRuleKubescapeVersionCompatible(rule_v1_0_133.Attributes, buildNumberMock))