Skip to content

Commit a640201

Browse files
cx-antero-silvacx-antero-silva
committed
fix issue in test
1 parent 693e6ee commit a640201

File tree

8 files changed

+367
-7
lines changed

8 files changed

+367
-7
lines changed

‎assets/queries/k8s/ingress_whitelist_open_to_all/query.rego‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ CxPolicy[result] {
1313
"documentId": input.document[i].id,
1414
"resourceType": document.kind,
1515
"resourceName": metadata.name,
16-
"searchKey": sprintf("metadata.name={{%s}}.metadata.annotations.nginx.ingress.kubernetes.io/whitelist-source-range", [metadata.name]),
16+
"searchKey": sprintf("metadata.name={{%s}}.annotations", [metadata.name]),
1717
"issueType": "IncorrectValue",
1818
"keyExpectedValue": sprintf("Ingress '%s' whitelist-source-range should restrict access to specific IP ranges", [metadata.name]),
1919
"keyActualValue": sprintf("Ingress '%s' whitelist-source-range is set to '%s', allowing access from all IP addresses", [metadata.name, whitelist]),

‎assets/queries/k8s/ingress_whitelist_open_to_all/test/positive_expected_result.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,16 @@
22
{
33
"queryName": "Ingress Whitelist Open To All IPs",
44
"severity": "HIGH",
5-
"line": 6
5+
"line": 5
66
},
77
{
88
"queryName": "Ingress Whitelist Open To All IPs",
99
"severity": "HIGH",
10-
"line": 25
10+
"line": 24
1111
},
1212
{
1313
"queryName": "Ingress Whitelist Open To All IPs",
1414
"severity": "HIGH",
15-
"line": 44
15+
"line": 43
1616
}
1717
]

‎assets/queries/k8s/network_policy_ingress_not_restricted/query.rego‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ CxPolicy[result] {
1818
"documentId": input.document[i].id,
1919
"resourceType": document.kind,
2020
"resourceName": metadata.name,
21-
"searchKey": sprintf("metadata.name={{%s}}.spec.ingress[%d]", [metadata.name, j]),
21+
"searchKey": sprintf("metadata.name={{%s}}.spec.ingress", [metadata.name]),
2222
"issueType": "MissingAttribute",
2323
"keyExpectedValue": sprintf("NetworkPolicy '%s' ingress rule [%d] should define a 'from' block to restrict source IPs", [metadata.name, j]),
2424
"keyActualValue": sprintf("NetworkPolicy '%s' ingress rule [%d] has no 'from' block, allowing traffic from all sources", [metadata.name, j]),

‎assets/queries/k8s/network_policy_ingress_not_restricted/test/positive_expected_result.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22
{
33
"queryName": "Network Policy Ingress Not Restricted",
44
"severity": "HIGH",
5-
"line": 12
5+
"line": 11
66
},
77
{
88
"queryName": "Network Policy Ingress Not Restricted",
99
"severity": "HIGH",
10-
"line": 23
10+
"line": 22
1111
}
1212
]

‎e2e/tmp-kics-ar/194604684.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
resource "alicloud_ram_account_password_policy" "corporate1" {
2+
require_lowercase_characters = false
3+
require_uppercase_characters = false
4+
require_numbers = false
5+
require_symbols = false
6+
hard_expiry = true
7+
password_reuse_prevention = 5
8+
max_login_attempts = 3
9+
}
10+
11+
resource "alicloud_ram_account_password_policy" "corporate2" {
12+
minimum_password_length = 14
13+
require_lowercase_characters = false
14+
require_uppercase_characters = false
15+
require_numbers = false
16+
require_symbols = false
17+
hard_expiry = true
18+
password_reuse_prevention = 5
19+
max_login_attempts = 3
20+
}

‎e2e/tmp-kics-ar/985110139.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
resource "alicloud_ram_account_password_policy" "corporate1" {
2+
require_lowercase_characters = false
3+
require_uppercase_characters = false
4+
require_numbers = false
5+
require_symbols = false
6+
hard_expiry = true
7+
password_reuse_prevention = 5
8+
max_login_attempts = 3
9+
}
10+
11+
resource "alicloud_ram_account_password_policy" "corporate2" {
12+
minimum_password_length = 14
13+
require_lowercase_characters = false
14+
require_uppercase_characters = false
15+
require_numbers = false
16+
require_symbols = false
17+
hard_expiry = true
18+
password_reuse_prevention = 5
19+
max_login_attempts = 3
20+
}

‎e2e/tmp-kics-ar/results-remediate-all.json‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
{
2+
"kics_version": "development",
3+
"files_scanned": 1,
4+
"lines_scanned": 0,
5+
"files_parsed": 1,
6+
"lines_parsed": 0,
7+
"lines_ignored": 0,
8+
"files_failed_to_scan": 0,
9+
"queries_total": 3,
10+
"queries_failed_to_execute": 0,
11+
"queries_failed_to_compute_similarity_id": 0,
12+
"scan_id": "console",
13+
"severity_counters": {
14+
"CRITICAL": 0,
15+
"HIGH": 1,
16+
"INFO": 0,
17+
"LOW": 0,
18+
"MEDIUM": 4
19+
},
20+
"total_counter": 5,
21+
"total_bom_resources": 0,
22+
"start": "0001-01-01T00:00:00Z",
23+
"end": "0001-01-01T00:00:00Z",
24+
"paths": [
25+
"/Users/anterosilva/Documents/PM/Monthly Data Review/kics/e2e/tmp-kics-ar/194604684.tf"
26+
],
27+
"queries": [
28+
{
29+
"query_name": "Ram Account Password Policy Not Required Minimum Length",
30+
"query_id": "a9dfec39-a740-4105-bbd6-721ba163c053",
31+
"query_url": "",
32+
"severity": "HIGH",
33+
"platform": "Terraform",
34+
"cloud_provider": "ALICLOUD",
35+
"category": "Secret Management",
36+
"experimental": false,
37+
"description": "Ram Account Password Policy should have 'minimum_password_length' defined and set to 14 or above",
38+
"description_id": "a8b47743",
39+
"cis_description_id": "testCISID",
40+
"cis_description_title": "testCISTitle",
41+
"cis_description_text": "testCISDescription",
42+
"files": [
43+
{
44+
"file_name": "/Users/anterosilva/Documents/PM/Monthly Data Review/kics/e2e/tmp-kics-ar/194604684.tf",
45+
"similarity_id": "f282fa13cf5e4ffd4bbb0ee2059f8d0240edcd2ca54b3bb71633145d961de5ce",
46+
"line": 1,
47+
"vuln_lines": null,
48+
"resource_type": "alicloud_ram_account_password_policy",
49+
"resource_name": "corporate1",
50+
"issue_type": "MissingAttribute",
51+
"search_key": "alicloud_ram_account_password_policy[corporate1]",
52+
"search_line": 0,
53+
"search_value": "",
54+
"expected_value": "'minimum_password_length' is defined and set to 14 or above ",
55+
"actual_value": "'minimum_password_length' is not defined",
56+
"remediation": "minimum_password_length = 14",
57+
"remediation_type": "addition"
58+
}
59+
]
60+
},
61+
{
62+
"query_name": "RAM Account Password Policy Not Required Symbols",
63+
"query_id": "41a38329-d81b-4be4-aef4-55b2615d3282",
64+
"query_url": "",
65+
"severity": "MEDIUM",
66+
"platform": "Terraform",
67+
"cloud_provider": "ALICLOUD",
68+
"category": "Secret Management",
69+
"experimental": false,
70+
"description": "RAM account password security should require at least one symbol",
71+
"description_id": "f3616c34",
72+
"cis_description_id": "testCISID",
73+
"cis_description_title": "testCISTitle",
74+
"cis_description_text": "testCISDescription",
75+
"files": [
76+
{
77+
"file_name": "/Users/anterosilva/Documents/PM/Monthly Data Review/kics/e2e/tmp-kics-ar/194604684.tf",
78+
"similarity_id": "87abbee5d0ec977ba193371c702dca2c040ea902d2e606806a63b66119ff89bc",
79+
"line": 5,
80+
"vuln_lines": null,
81+
"resource_type": "alicloud_ram_account_password_policy",
82+
"resource_name": "corporate1",
83+
"issue_type": "IncorrectValue",
84+
"search_key": "resource.alicloud_ram_account_password_policy[corporate1].require_symbols",
85+
"search_line": 0,
86+
"search_value": "",
87+
"expected_value": "resource.alicloud_ram_account_password_policy[corporate1].require_symbols is set to 'true'",
88+
"actual_value": "resource.alicloud_ram_account_password_policy[corporate1].require_symbols is configured as 'false'",
89+
"remediation": "{\"after\":\"true\",\"before\":\"false\"}",
90+
"remediation_type": "replacement"
91+
},
92+
{
93+
"file_name": "/Users/anterosilva/Documents/PM/Monthly Data Review/kics/e2e/tmp-kics-ar/194604684.tf",
94+
"similarity_id": "2628457bdb548986936dbd7d8479524f2079f26d36b9faa9f34423e796fe62c8",
95+
"line": 16,
96+
"vuln_lines": null,
97+
"resource_type": "alicloud_ram_account_password_policy",
98+
"resource_name": "corporate2",
99+
"issue_type": "IncorrectValue",
100+
"search_key": "resource.alicloud_ram_account_password_policy[corporate2].require_symbols",
101+
"search_line": 0,
102+
"search_value": "",
103+
"expected_value": "resource.alicloud_ram_account_password_policy[corporate2].require_symbols is set to 'true'",
104+
"actual_value": "resource.alicloud_ram_account_password_policy[corporate2].require_symbols is configured as 'false'",
105+
"remediation": "{\"after\":\"true\",\"before\":\"false\"}",
106+
"remediation_type": "replacement"
107+
}
108+
]
109+
},
110+
{
111+
"query_name": "Ram Account Password Policy Max Password Age Unrecommended",
112+
"query_id": "2bb13841-7575-439e-8e0a-cccd9ede2fa8",
113+
"query_url": "",
114+
"severity": "MEDIUM",
115+
"platform": "Terraform",
116+
"cloud_provider": "ALICLOUD",
117+
"category": "Secret Management",
118+
"experimental": false,
119+
"description": "Ram Account Password Policy Password 'max_password_age' should be higher than 0 and lower than 91",
120+
"description_id": "6056f5ca",
121+
"cis_description_id": "testCISID",
122+
"cis_description_title": "testCISTitle",
123+
"cis_description_text": "testCISDescription",
124+
"files": [
125+
{
126+
"file_name": "/Users/anterosilva/Documents/PM/Monthly Data Review/kics/e2e/tmp-kics-ar/194604684.tf",
127+
"similarity_id": "f1d17b3513439e03cd0a25690acc44755d4e68decfaa6c03522b20a65b26b617",
128+
"line": 5,
129+
"vuln_lines": null,
130+
"resource_type": "alicloud_ram_account_password_policy",
131+
"resource_name": "corporate1",
132+
"issue_type": "MissingAttribute",
133+
"search_key": "alicloud_ram_account_password_policy[corporate1]",
134+
"search_line": 0,
135+
"search_value": "",
136+
"expected_value": "'max_password_age' should be higher than 0 and lower than 91",
137+
"actual_value": "'max_password_age' is not defined",
138+
"remediation": "max_password_age = 12",
139+
"remediation_type": "addition"
140+
},
141+
{
142+
"file_name": "/Users/anterosilva/Documents/PM/Monthly Data Review/kics/e2e/tmp-kics-ar/194604684.tf",
143+
"similarity_id": "404ad93f4a485d0dd1b1621489c38be9c98dcc0b94396701ecad162e28db97fd",
144+
"line": 11,
145+
"vuln_lines": null,
146+
"resource_type": "alicloud_ram_account_password_policy",
147+
"resource_name": "corporate2",
148+
"issue_type": "MissingAttribute",
149+
"search_key": "alicloud_ram_account_password_policy[corporate2]",
150+
"search_line": 0,
151+
"search_value": "",
152+
"expected_value": "'max_password_age' should be higher than 0 and lower than 91",
153+
"actual_value": "'max_password_age' is not defined",
154+
"remediation": "max_password_age = 12",
155+
"remediation_type": "addition"
156+
}
157+
]
158+
}
159+
]
160+
}

0 commit comments

Comments
 (0)