Skip to content

Commit 712dcd3

Browse files
nikpivkinnikpivkin
authored
fix(misconf): clear location URI for SARIF (aquasecurity#6405)
1 parent 625f22b commit 712dcd3

File tree

2 files changed

+131
-5
lines changed

2 files changed

+131
-5
lines changed

‎pkg/report/sarif.go‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -178,15 +178,16 @@ func (sw *SarifWriter) Write(ctx context.Context, report types.Report) error {
178178
})
179179
}
180180
for _, misconf := range res.Misconfigurations {
181+
locationURI := clearURI(res.Target)
181182
sw.addSarifResult(&sarifData{
182183
title: "misconfiguration",
183184
vulnerabilityId: misconf.ID,
184185
severity: misconf.Severity,
185186
cvssScore: severityToScore(misconf.Severity),
186187
url: misconf.PrimaryURL,
187188
resourceClass: res.Class,
188-
artifactLocation: target,
189-
locationMessage: target,
189+
artifactLocation: locationURI,
190+
locationMessage: locationURI,
190191
locations: []location{
191192
{
192193
startLine: misconf.CauseMetadata.StartLine,
@@ -201,7 +202,7 @@ func (sw *SarifWriter) Write(ctx context.Context, report types.Report) error {
201202
helpMarkdown: fmt.Sprintf("**Misconfiguration %v**\n| Type | Severity | Check | Message | Link |\n| --- | --- | --- | --- | --- |\n|%v|%v|%v|%s|[%v](%v)|\n\n%v",
202203
misconf.ID, misconf.Type, misconf.Severity, misconf.Title, misconf.Message, misconf.ID, misconf.PrimaryURL, misconf.Description),
203204
message: fmt.Sprintf("Artifact: %v\nType: %v\nVulnerability %v\nSeverity: %v\nMessage: %v\nLink: [%v](%v)",
204-
res.Target, res.Type, misconf.ID, misconf.Severity, misconf.Message, misconf.ID, misconf.PrimaryURL),
205+
locationURI, res.Type, misconf.ID, misconf.Severity, misconf.Message, misconf.ID, misconf.PrimaryURL),
205206
})
206207
}
207208
for _, secret := range res.Secrets {
@@ -338,7 +339,11 @@ func ToPathUri(input string, resultClass types.ResultClass) string {
338339
input = ref.Context().RepositoryStr()
339340
}
340341

341-
return strings.ReplaceAll(strings.ReplaceAll(input, "\\", "/"), "git::https:/", "")
342+
return clearURI(input)
343+
}
344+
345+
func clearURI(s string) string {
346+
return strings.ReplaceAll(strings.ReplaceAll(s, "\\", "/"), "git::https:/", "")
342347
}
343348

344349
func (sw *SarifWriter) getLocations(name, version, path string, pkgs []ftypes.Package) []location {

‎pkg/report/sarif_test.go‎

Lines changed: 122 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package report_test
22

33
import (
44
"bytes"
5+
"context"
56
"encoding/json"
67
"testing"
78

@@ -541,6 +542,126 @@ func TestReportWriter_Sarif(t *testing.T) {
541542
},
542543
},
543544
},
545+
{
546+
name: "ref to github",
547+
input: types.Report{
548+
Results: types.Results{
549+
{
550+
Target: "git::https:/github.com/terraform-google-modules/terraform-google-kubernetes-engine?ref=c4809044b52b91505bfba5ef9f25526aa0361788/modules/workload-identity/main.tf",
551+
Class: types.ClassConfig,
552+
Type: ftypes.Terraform,
553+
Misconfigurations: []types.DetectedMisconfiguration{
554+
{
555+
Type: "Terraform Security Check",
556+
ID: "AVD-GCP-0007",
557+
AVDID: "AVD-GCP-0007",
558+
Title: "Service accounts should not have roles assigned with excessive privileges",
559+
Description: "Service accounts should have a minimal set of permissions assigned in order to do their job. They should never have excessive access as if compromised, an attacker can escalate privileges and take over the entire account.",
560+
Message: "Service account is granted a privileged role.",
561+
Query: "data..",
562+
Resolution: "Limit service account access to minimal required set",
563+
Severity: "HIGH",
564+
PrimaryURL: "https://avd.aquasec.com/misconfig/avd-gcp-0007",
565+
References: []string{
566+
"https://cloud.google.com/iam/docs/understanding-roles",
567+
"https://avd.aquasec.com/misconfig/avd-gcp-0007",
568+
},
569+
Status: "Fail",
570+
CauseMetadata: ftypes.CauseMetadata{
571+
StartLine: 91,
572+
EndLine: 91,
573+
Occurrences: []ftypes.Occurrence{
574+
{
575+
Resource: "google_project_iam_member.workload_identity_sa_bindings[\"roles/storage.admin\"]",
576+
Filename: "git::https:/github.com/terraform-google-modules/terraform-google-kubernetes-engine?ref=c4809044b52b91505bfba5ef9f25526aa0361788/modules/workload-identity/main.tf",
577+
Location: ftypes.Location{
578+
StartLine: 87,
579+
EndLine: 93,
580+
},
581+
},
582+
},
583+
},
584+
},
585+
},
586+
},
587+
},
588+
},
589+
want: &sarif.Report{
590+
Version: "2.1.0",
591+
Schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
592+
Runs: []*sarif.Run{
593+
{
594+
Tool: *sarif.NewTool(
595+
&sarif.ToolComponent{
596+
FullName: lo.ToPtr("Trivy Vulnerability Scanner"),
597+
Name: "Trivy",
598+
Version: lo.ToPtr(""),
599+
InformationURI: lo.ToPtr("https://github.com/aquasecurity/trivy"),
600+
Rules: []*sarif.ReportingDescriptor{
601+
{
602+
ID: "AVD-GCP-0007",
603+
Name: lo.ToPtr("Misconfiguration"),
604+
ShortDescription: sarif.NewMultiformatMessageString("Service accounts should not have roles assigned with excessive privileges"),
605+
FullDescription: sarif.NewMultiformatMessageString("Service accounts should have a minimal set of permissions assigned in order to do their job. They should never have excessive access as if compromised, an attacker can escalate privileges and take over the entire account."),
606+
DefaultConfiguration: &sarif.ReportingConfiguration{
607+
Level: "error",
608+
},
609+
HelpURI: lo.ToPtr("https://avd.aquasec.com/misconfig/avd-gcp-0007"),
610+
Help: &sarif.MultiformatMessageString{
611+
Text: lo.ToPtr("Misconfiguration AVD-GCP-0007\nType: Terraform Security Check\nSeverity: HIGH\nCheck: Service accounts should not have roles assigned with excessive privileges\nMessage: Service account is granted a privileged role.\nLink: [AVD-GCP-0007](https://avd.aquasec.com/misconfig/avd-gcp-0007)\nService accounts should have a minimal set of permissions assigned in order to do their job. They should never have excessive access as if compromised, an attacker can escalate privileges and take over the entire account."),
612+
Markdown: lo.ToPtr("**Misconfiguration AVD-GCP-0007**\n| Type | Severity | Check | Message | Link |\n| --- | --- | --- | --- | --- |\n|Terraform Security Check|HIGH|Service accounts should not have roles assigned with excessive privileges|Service account is granted a privileged role.|[AVD-GCP-0007](https://avd.aquasec.com/misconfig/avd-gcp-0007)|\n\nService accounts should have a minimal set of permissions assigned in order to do their job. They should never have excessive access as if compromised, an attacker can escalate privileges and take over the entire account."),
613+
},
614+
Properties: sarif.Properties{
615+
"tags": []interface{}{
616+
"misconfiguration",
617+
"security",
618+
"HIGH",
619+
},
620+
"precision": "very-high",
621+
"security-severity": "8.0",
622+
},
623+
},
624+
},
625+
},
626+
),
627+
Results: []*sarif.Result{
628+
{
629+
RuleID: lo.ToPtr("AVD-GCP-0007"),
630+
RuleIndex: lo.ToPtr(uint(0)),
631+
Level: lo.ToPtr("error"),
632+
Message: *sarif.NewTextMessage("Artifact: github.com/terraform-google-modules/terraform-google-kubernetes-engine?ref=c4809044b52b91505bfba5ef9f25526aa0361788/modules/workload-identity/main.tf\nType: terraform\nVulnerability AVD-GCP-0007\nSeverity: HIGH\nMessage: Service account is granted a privileged role.\nLink: [AVD-GCP-0007](https://avd.aquasec.com/misconfig/avd-gcp-0007)"),
633+
Locations: []*sarif.Location{
634+
{
635+
PhysicalLocation: sarif.NewPhysicalLocation().
636+
WithArtifactLocation(
637+
&sarif.ArtifactLocation{
638+
URI: lo.ToPtr("github.com/terraform-google-modules/terraform-google-kubernetes-engine?ref=c4809044b52b91505bfba5ef9f25526aa0361788/modules/workload-identity/main.tf"),
639+
URIBaseId: lo.ToPtr("ROOTPATH"),
640+
},
641+
).
642+
WithRegion(
643+
&sarif.Region{
644+
StartLine: lo.ToPtr(91),
645+
StartColumn: lo.ToPtr(1),
646+
EndLine: lo.ToPtr(91),
647+
EndColumn: lo.ToPtr(1),
648+
},
649+
),
650+
Message: sarif.NewTextMessage("github.com/terraform-google-modules/terraform-google-kubernetes-engine?ref=c4809044b52b91505bfba5ef9f25526aa0361788/modules/workload-identity/main.tf"),
651+
},
652+
},
653+
},
654+
},
655+
ColumnKind: "utf16CodeUnits",
656+
OriginalUriBaseIDs: map[string]*sarif.ArtifactLocation{
657+
"ROOTPATH": {
658+
URI: lo.ToPtr("file:///"),
659+
},
660+
},
661+
},
662+
},
663+
},
664+
},
544665
}
545666

546667
for _, tt := range tests {
@@ -549,7 +670,7 @@ func TestReportWriter_Sarif(t *testing.T) {
549670
w := report.SarifWriter{
550671
Output: sarifWritten,
551672
}
552-
err := w.Write(nil, tt.input)
673+
err := w.Write(context.TODO(), tt.input)
553674
assert.NoError(t, err)
554675

555676
result := &sarif.Report{}

0 commit comments

Comments
 (0)