fix(misconf): unmark cty values before access (#9495)

Signed-off-by: nikpivkin <[email protected]>

Author: nikpivkin

pkg/iac/scanners/terraform/parser/parser_test.go

@@ -2877,3 +2877,39 @@ module "test" {
 
 	require.Len(t, modules, 1)
 }
+
+func Test_MarkedValues(t *testing.T) {
+
+	tests := []struct {
+		name string
+		src  string
+	}{
+		{
+			name: "marked object",
+			src: `resource "foo" "bar" {
+  test = sensitive({})
+}`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			files := map[string]string{
+				`main.tf`: tt.src,
+			}
+
+			fsys := testutil.CreateFS(t, files)
+			parser := New(fsys, "",
+				OptionWithSkipCachedModules(true),
+				OptionStopOnHCLError(true),
+			)
+			err := parser.ParseFS(t.Context(), ".")
+			require.NoError(t, err)
+
+			modules, err := parser.EvaluateAll(t.Context())
+			require.NoError(t, err)
+
+			require.Len(t, modules, 1)
+		})
+	}
+}

pkg/iac/terraform/attribute.go

@@ -391,12 +391,10 @@ func (a *Attribute) valueToStrings(value cty.Value) (results []iacTypes.StringVa
 			results = []iacTypes.StringValue{iacTypes.StringUnresolvable(a.metadata)}
 		}
 	}()
-	if value.IsNull() {
-		return []iacTypes.StringValue{iacTypes.StringUnresolvable(a.metadata)}
-	}
-	if !value.IsKnown() {
+	if value.IsNull() || !value.IsKnown() {
 		return []iacTypes.StringValue{iacTypes.StringUnresolvable(a.metadata)}
 	}
+
 	if value.Type().IsListType() || value.Type().IsTupleType() || value.Type().IsSetType() {
 		for _, val := range value.AsValueSlice() {
 			results = append(results, a.valueToString(val))
@@ -828,7 +826,9 @@ func safeOp[T any](a *Attribute, fn func(cty.Value) T) T {
 		return res
 	}
 
-	return fn(val)
+	unmarked, _ := val.UnmarkDeep()
+
+	return fn(unmarked)
 }
 
 // RewriteExpr applies the given function `transform` to the expression of the attribute,

pkg/iac/terraform/context/context.go

@@ -142,5 +142,10 @@ func mergeObjects(a, b cty.Value) cty.Value {
 }
 
 func isNotEmptyObject(val cty.Value) bool {
-	return !val.IsNull() && val.IsKnown() && val.Type().IsObjectType() && val.LengthInt() > 0
+	if val.IsNull() || !val.IsKnown() || !val.Type().IsObjectType() {
+		return false
+	}
+
+	unmarked, _ := val.Unmark()
+	return unmarked.LengthInt() > 0
 }