Revert "Revert "feat(scanner): Break out options for enabling libs an…

…d policies (#1280)" (#1298)" (#1357) * Revert "Revert "feat(scanner): Break out options for enabling libs and policies (#1280)" (#1298)" This reverts commit 63a8b4f. * add loadembedded for terraformplan Signed-off-by: Simar <[email protected]> * fix tests Signed-off-by: Simar <[email protected]> --------- Signed-off-by: Simar <[email protected]>
aquasecurity · Jul 16, 2023 · 931764a · 931764a
1 parent e7e17b9
commit 931764a
Show file tree

Hide file tree

Showing 21 changed files with 227 additions and 147 deletions.
diff --git a/cmd/defsec/aws.go b/cmd/defsec/aws.go
@@ -40,6 +40,7 @@ func scanAWS(stdout, stderr io.Writer) error {
 
 	opts := []options.ScannerOption{
 		options.ScannerWithEmbeddedPolicies(true),
+		options.ScannerWithEmbeddedLibraries(true),
 	}
 
 	if flagDebug {

diff --git a/cmd/defsec/fs.go b/cmd/defsec/fs.go
@@ -36,6 +36,7 @@ func scanFS(dir string, stdout, stderr io.Writer) error {
 
 	opts := []options.ScannerOption{
 		options.ScannerWithEmbeddedPolicies(true),
+		options.ScannerWithEmbeddedLibraries(true),
 	}
 
 	if flagDebug {

diff --git a/pkg/rego/load.go b/pkg/rego/load.go
@@ -94,18 +94,8 @@ func (s *Scanner) LoadEmbeddedLibraries() error {
 	return nil
 }
 
-func (s *Scanner) LoadPolicies(loadEmbedded bool, srcFS fs.FS, paths []string, readers []io.Reader) error {
-
-	if s.policies == nil {
-		s.policies = make(map[string]*ast.Module)
-	}
-
-	if s.policyFS != nil {
-		s.debug.Log("Overriding filesystem for policies!")
-		srcFS = s.policyFS
-	}
-
-	if loadEmbedded {
+func (s *Scanner) loadEmbedded(enableEmbeddedLibraries, enableEmbeddedPolicies bool) error {
+	if enableEmbeddedLibraries {
 		loadedLibs, errLoad := loadEmbeddedLibraries()
 		if errLoad != nil {
 			return fmt.Errorf("failed to load embedded rego libraries: %w", errLoad)
@@ -114,6 +104,9 @@ func (s *Scanner) LoadPolicies(loadEmbedded bool, srcFS fs.FS, paths []string, r
 			s.policies[name] = policy
 		}
 		s.debug.Log("Loaded %d embedded libraries.", len(loadedLibs))
+	}
+
+	if enableEmbeddedPolicies {
 		loaded, err := loadEmbeddedPolicies()
 		if err != nil {
 			return fmt.Errorf("failed to load embedded rego policies: %w", err)
@@ -124,6 +117,24 @@ func (s *Scanner) LoadPolicies(loadEmbedded bool, srcFS fs.FS, paths []string, r
 		s.debug.Log("Loaded %d embedded policies.", len(loaded))
 	}
 
+	return nil
+}
+
+func (s *Scanner) LoadPolicies(enableEmbeddedLibraries, enableEmbeddedPolicies bool, srcFS fs.FS, paths []string, readers []io.Reader) error {
+
+	if s.policies == nil {
+		s.policies = make(map[string]*ast.Module)
+	}
+
+	if s.policyFS != nil {
+		s.debug.Log("Overriding filesystem for policies!")
+		srcFS = s.policyFS
+	}
+
+	if err := s.loadEmbedded(enableEmbeddedLibraries, enableEmbeddedPolicies); err != nil {
+		return err
+	}
+
 	var err error
 	if len(paths) > 0 {
 		loaded, err := s.loadPoliciesFromDirs(srcFS, paths)

diff --git a/pkg/rego/scanner.go b/pkg/rego/scanner.go
@@ -46,6 +46,10 @@ type Scanner struct {
 	sourceType     types.Source
 }
 
+func (s *Scanner) SetUseEmbeddedLibraries(b bool) {
+	// handled externally
+}
+
 func (s *Scanner) SetSpec(spec string) {
 	s.spec = spec
 }
@@ -59,6 +63,7 @@ func (s *Scanner) SetFrameworks(frameworks []framework.Framework) {
 func (s *Scanner) SetUseEmbeddedPolicies(b bool) {
 	// handled externally
 }
+
 func (s *Scanner) trace(heading string, input interface{}) {
 	if s.traceWriter == nil {
 		return

diff --git a/pkg/rego/scanner_test.go b/pkg/rego/scanner_test.go
@@ -35,7 +35,7 @@ deny {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -70,7 +70,7 @@ deny {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"/policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"/policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -105,7 +105,7 @@ warn {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -137,7 +137,7 @@ deny {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -180,7 +180,7 @@ exception[ns] {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -228,7 +228,7 @@ exception[ns] {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -265,7 +265,7 @@ exception[rules] {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -301,7 +301,7 @@ exception[rules] {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -335,7 +335,7 @@ deny_evil {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -366,7 +366,7 @@ deny[msg] {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -404,7 +404,7 @@ deny[res] {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -446,7 +446,7 @@ deny[res] {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -500,7 +500,7 @@ deny[res] {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -549,7 +549,7 @@ deny {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -583,7 +583,7 @@ deny {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -614,7 +614,7 @@ deny {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -649,7 +649,7 @@ deny {
 	scanner := NewScanner(types.SourceJSON, options.ScannerWithTrace(traceBuffer))
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -683,7 +683,7 @@ deny {
 	scanner := NewScanner(types.SourceJSON, options.ScannerWithPerResultTracing(true))
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -721,7 +721,7 @@ deny {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -754,7 +754,7 @@ deny {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -801,7 +801,7 @@ deny {
 	scanner := NewScanner(types.SourceJSON)
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{
@@ -840,7 +840,7 @@ deny {
 	scanner.SetRegoErrorLimit(0) // override to not allow any errors
 	assert.ErrorContains(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 		"undefined ref: input.evil",
 	)
 }
@@ -862,7 +862,7 @@ deny {
 	scanner := NewScanner(types.SourceDockerfile)
 	assert.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 }
 
@@ -882,7 +882,7 @@ deny {
 	scanner.SetRegoErrorLimit(0) // override to not allow any errors
 	assert.ErrorContains(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 		"undefined ref: input.evil",
 	)
 }
@@ -916,7 +916,7 @@ deny {
 
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{})
@@ -956,7 +956,7 @@ deny {
 
 	require.NoError(
 		t,
-		scanner.LoadPolicies(false, srcFS, []string{"policies"}, nil),
+		scanner.LoadPolicies(false, false, srcFS, []string{"policies"}, nil),
 	)
 
 	results, err := scanner.ScanInput(context.TODO(), Input{})

diff --git a/pkg/scanners/azure/arm/scanner.go b/pkg/scanners/azure/arm/scanner.go
@@ -28,17 +28,18 @@ var _ scanners.FSScanner = (*Scanner)(nil)
 var _ options.ConfigurableScanner = (*Scanner)(nil)
 
 type Scanner struct {
-	scannerOptions []options.ScannerOption
-	parserOptions  []options.ParserOption
-	debug          debug.Logger
-	frameworks     []framework.Framework
-	skipRequired   bool
-	regoOnly       bool
-	loadEmbedded   bool
-	policyDirs     []string
-	policyReaders  []io.Reader
-	regoScanner    *rego.Scanner
-	spec           string
+	scannerOptions        []options.ScannerOption
+	parserOptions         []options.ParserOption
+	debug                 debug.Logger
+	frameworks            []framework.Framework
+	skipRequired          bool
+	regoOnly              bool
+	loadEmbeddedPolicies  bool
+	loadEmbeddedLibraries bool
+	policyDirs            []string
+	policyReaders         []io.Reader
+	regoScanner           *rego.Scanner
+	spec                  string
 	sync.Mutex
 }
 
@@ -87,8 +88,12 @@ func (s *Scanner) SetDataFilesystem(_ fs.FS) {
 	// handled by rego when option is passed on
 }
 
-func (s *Scanner) SetUseEmbeddedPolicies(loadEmbedded bool) {
-	s.loadEmbedded = loadEmbedded
+func (s *Scanner) SetUseEmbeddedPolicies(b bool) {
+	s.loadEmbeddedPolicies = b
+}
+
+func (s *Scanner) SetUseEmbeddedLibraries(b bool) {
+	s.loadEmbeddedLibraries = b
 }
 
 func (s *Scanner) SetFrameworks(frameworks []framework.Framework) {
@@ -109,7 +114,7 @@ func (s *Scanner) initRegoScanner(srcFS fs.FS) error {
 	}
 	regoScanner := rego.NewScanner(types.SourceCloud, s.scannerOptions...)
 	regoScanner.SetParentDebugLogger(s.debug)
-	if err := regoScanner.LoadPolicies(s.loadEmbedded, srcFS, s.policyDirs, s.policyReaders); err != nil {
+	if err := regoScanner.LoadPolicies(s.loadEmbeddedLibraries, s.loadEmbeddedPolicies, srcFS, s.policyDirs, s.policyReaders); err != nil {
 		return err
 	}
 	s.regoScanner = regoScanner