feat(scanner): Break out options for enabling libs and policies #1280

simar7 · 2023-04-14T01:20:14Z

This adds the SetUseEmbeddedLibraries option for scanners. It is needed in cases where we only want to load libraries but not policies.

Signed-off-by: Simar [email protected]

simar7 · 2023-04-14T22:49:44Z

@chen-keinan could you help me review this?

I have made a PR in trivy to adapt to this change: aquasecurity/trivy#4070 - are there other users of defsec that you know that will need a change?

chen-keinan · 2023-04-18T07:16:29Z

pkg/scanners/azure/arm/scanner.go

 	regoScanner := rego.NewScanner(types.SourceCloud, s.scannerOptions...)
 	regoScanner.SetParentDebugLogger(s.debug)
-	if err := regoScanner.LoadPolicies(s.loadEmbedded, srcFS, s.policyDirs, s.policyReaders); err != nil {
+	if err := regoScanner.LoadPolicies(s.loadEmbeddedLibraries, s.loadEmbeddedPolicies, srcFS, s.policyDirs, s.policyReaders); err != nil {


nit: maybe pass s (Scanner) to LoadPolicies method as there are too many params

Yeah that's a good idea, however s could be any type of Scanner. I tried to implement this with generics but quickly ran into a dead end that a method on a receiver where the base (in this case rego scanner) isn't generic cannot accept generic parameters. https://go.googlesource.com/proposal/+/refs/heads/master/design/43651-type-parameters.md#No-parameterized-methods

I will revisit this again. It will be a lot cleaner if we only passed s since all function inputs (except srcFS) come from s.

chen-keinan · 2023-04-18T07:17:20Z

pkg/scanners/cloud/aws/scanner.go

 	regoScanner := rego.NewScanner(types.SourceCloud, s.options...)
 	regoScanner.SetParentDebugLogger(s.debug)
-	if err := regoScanner.LoadPolicies(s.useEmbedded, srcFS, s.policyDirs, s.policyReaders); err != nil {
+	if err := regoScanner.LoadPolicies(s.loadEmbeddedLibraries, s.loadEmbeddedPolicies, srcFS, s.policyDirs, s.policyReaders); err != nil {


same as above comment

chen-keinan · 2023-04-18T07:17:31Z

pkg/scanners/cloudformation/scanner.go

 	regoScanner := rego.NewScanner(types.SourceCloud, s.options...)
 	regoScanner.SetParentDebugLogger(s.debug)
-	if err := regoScanner.LoadPolicies(s.loadEmbedded, srcFS, s.policyDirs, s.policyReaders); err != nil {
+	if err := regoScanner.LoadPolicies(s.loadEmbeddedLibraries, s.loadEmbeddedPolicies, srcFS, s.policyDirs, s.policyReaders); err != nil {


same as above

chen-keinan · 2023-04-18T07:17:39Z

pkg/scanners/dockerfile/scanner.go

 	regoScanner := rego.NewScanner(types.SourceDockerfile, s.options...)
 	regoScanner.SetParentDebugLogger(s.debug)
-	if err := regoScanner.LoadPolicies(s.loadEmbedded, srcFS, s.policyDirs, s.policyReaders); err != nil {
+	if err := regoScanner.LoadPolicies(s.loadEmbeddedLibraries, s.loadEmbeddedPolicies, srcFS, s.policyDirs, s.policyReaders); err != nil {


chen-keinan · 2023-04-18T07:17:47Z

pkg/scanners/helm/scanner.go

 		policyFS = s.policyFS
 	}
-	if err := regoScanner.LoadPolicies(s.loadEmbedded, policyFS, s.policyDirs, s.policyReaders); err != nil {
+	if err := regoScanner.LoadPolicies(s.loadEmbeddedLibraries, s.loadEmbeddedPolicies, policyFS, s.policyDirs, s.policyReaders); err != nil {


chen-keinan · 2023-04-18T07:18:24Z

pkg/scanners/kubernetes/scanner.go

 	regoScanner := rego.NewScanner(types.SourceKubernetes, s.options...)
 	regoScanner.SetParentDebugLogger(s.debug)
-	if err := regoScanner.LoadPolicies(s.loadEmbedded, srcFS, s.policyDirs, s.policyReaders); err != nil {
+	if err := regoScanner.LoadPolicies(s.loadEmbeddedLibraries, s.loadEmbeddedPolicies, srcFS, s.policyDirs, s.policyReaders); err != nil {


chen-keinan · 2023-04-18T07:19:40Z

pkg/scanners/toml/scanner.go

 	regoScanner := rego.NewScanner(types.SourceTOML, s.options...)
 	regoScanner.SetParentDebugLogger(s.debug)
-	if err := regoScanner.LoadPolicies(s.loadEmbedded, srcFS, s.policyDirs, s.policyReaders); err != nil {
+	if err := regoScanner.LoadPolicies(s.loadEmbeddedLibraries, s.loadEmbeddedPolicies, srcFS, s.policyDirs, s.policyReaders); err != nil {


chen-keinan · 2023-04-18T07:19:52Z

pkg/scanners/yaml/scanner.go

 	regoScanner := rego.NewScanner(types.SourceYAML, s.options...)
 	regoScanner.SetParentDebugLogger(s.debug)
-	if err := regoScanner.LoadPolicies(s.loadEmbedded, srcFS, s.policyDirs, s.policyReaders); err != nil {
+	if err := regoScanner.LoadPolicies(s.loadEmbeddedLibraries, s.loadEmbeddedPolicies, srcFS, s.policyDirs, s.policyReaders); err != nil {


chen-keinan · 2023-04-18T07:19:59Z

test/kubernetes_test.go

 	require.NoError(t, err)

-	scanner := kubernetes.NewScanner(options.ScannerWithEmbeddedPolicies(true))
+	scanner := kubernetes.NewScanner(options.ScannerWithEmbeddedPolicies(true), options.ScannerWithEmbeddedLibraries(true), options.ScannerWithEmbeddedLibraries(true))


chen-keinan · 2023-04-18T07:21:12Z

pkg/scanners/kubernetes/scanner_test.go

 `

-	results, err := NewScanner(options.ScannerWithEmbeddedPolicies(true)).ScanReader(context.TODO(), "k8s.yaml", strings.NewReader(file))
+	results, err := NewScanner(options.ScannerWithEmbeddedPolicies(true), options.ScannerWithEmbeddedLibraries(true), options.ScannerWithEmbeddedLibraries(true)).ScanReader(context.TODO(), "k8s.yaml", strings.NewReader(file))


nit:

Suggested change

results, err := NewScanner(options.ScannerWithEmbeddedPolicies(true), options.ScannerWithEmbeddedLibraries(true), options.ScannerWithEmbeddedLibraries(true)).ScanReader(context.TODO(), "k8s.yaml", strings.NewReader(file))

results, err := NewScanner(

options.ScannerWithEmbeddedPolicies(true),

options.ScannerWithEmbeddedLibraries(true),

options.ScannerWithEmbeddedLibraries(true)).ScanReader(context.TODO(), "k8s.yaml", strings.NewReader(file))

chen-keinan · 2023-04-18T07:22:17Z

@simar7 look good, I have added few nit comments , its up to you (no blocker)

Signed-off-by: Simar <[email protected]>

…es (#1280)" This reverts commit 97ff1b4.

…es (#1280)" (#1298) This reverts commit 97ff1b4.

…d policies (#1280)" (#1298)" This reverts commit 63a8b4f.

…d policies (#1280)" (#1298)" (#1357) * Revert "Revert "feat(scanner): Break out options for enabling libs and policies (#1280)" (#1298)" This reverts commit 63a8b4f. * add loadembedded for terraformplan Signed-off-by: Simar <[email protected]> * fix tests Signed-off-by: Simar <[email protected]> --------- Signed-off-by: Simar <[email protected]>

simar7 force-pushed the enable-embedded-libraries-option branch from c606912 to d885472 Compare April 14, 2023 20:24

simar7 marked this pull request as ready for review April 14, 2023 20:55

simar7 requested a review from giorod3 as a code owner April 14, 2023 20:55

simar7 mentioned this pull request Apr 14, 2023

feat(misconf): Add support for independently enabling libraries aquasecurity/trivy#4070

Merged

simar7 requested a review from chen-keinan April 14, 2023 22:48

simar7 force-pushed the enable-embedded-libraries-option branch from d885472 to 7e92a22 Compare April 17, 2023 22:35

chen-keinan previously approved these changes Apr 18, 2023

View reviewed changes

simar7 force-pushed the enable-embedded-libraries-option branch from 7e92a22 to d0fadf8 Compare April 19, 2023 01:28

simar7 dismissed chen-keinan’s stale review via ba33c6f April 19, 2023 02:50

simar7 added 5 commits April 18, 2023 22:58

feat(scanner): Break out options for enabling libs and policies

ed6c608

Signed-off-by: Simar <[email protected]>

refactor

e1c5664

Signed-off-by: Simar <[email protected]>

simplify terraform

190b7ba

Signed-off-by: Simar <[email protected]>

remove un-needed work

1d1afd4

Signed-off-by: Simar <[email protected]>

fix ident

220ede3

Signed-off-by: Simar <[email protected]>

simar7 force-pushed the enable-embedded-libraries-option branch from ba33c6f to 220ede3 Compare April 19, 2023 05:58

simar7 merged commit 97ff1b4 into master Apr 20, 2023

simar7 deleted the enable-embedded-libraries-option branch April 20, 2023 04:15

simar7 added a commit that referenced this pull request Apr 27, 2023

Revert "feat(scanner): Break out options for enabling libs and polici…

6fe10a3

…es (#1280)" This reverts commit 97ff1b4.

simar7 added a commit that referenced this pull request Apr 28, 2023

Revert "feat(scanner): Break out options for enabling libs and polici…

63a8b4f

…es (#1280)" (#1298) This reverts commit 97ff1b4.

simar7 added a commit that referenced this pull request Jun 23, 2023

Revert "Revert "feat(scanner): Break out options for enabling libs an…

7a82887

…d policies (#1280)" (#1298)" This reverts commit 63a8b4f.

simar7 added a commit that referenced this pull request Jul 5, 2023

Revert "Revert "feat(scanner): Break out options for enabling libs an…

3dff0b8

…d policies (#1280)" (#1298)" This reverts commit 63a8b4f.

simar7 added a commit that referenced this pull request Jul 8, 2023

Revert "Revert "feat(scanner): Break out options for enabling libs an…

b161ae6

…d policies (#1280)" (#1298)" This reverts commit 63a8b4f.

simar7 added a commit that referenced this pull request Jul 11, 2023

Revert "Revert "feat(scanner): Break out options for enabling libs an…

dc0c5b2

…d policies (#1280)" (#1298)" This reverts commit 63a8b4f.

simar7 added a commit that referenced this pull request Jul 16, 2023

Revert "Revert "feat(scanner): Break out options for enabling libs an…

6bebb98

…d policies (#1280)" (#1298)" This reverts commit 63a8b4f.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(scanner): Break out options for enabling libs and policies #1280

feat(scanner): Break out options for enabling libs and policies #1280

Uh oh!

simar7 commented Apr 14, 2023

Uh oh!

simar7 commented Apr 14, 2023

Uh oh!

chen-keinan Apr 18, 2023

Uh oh!

simar7 Apr 19, 2023

Uh oh!

chen-keinan Apr 18, 2023

Uh oh!

chen-keinan Apr 18, 2023

Uh oh!

chen-keinan Apr 18, 2023

Uh oh!

chen-keinan Apr 18, 2023

Uh oh!

chen-keinan Apr 18, 2023

Uh oh!

chen-keinan Apr 18, 2023

Uh oh!

chen-keinan Apr 18, 2023

Uh oh!

chen-keinan Apr 18, 2023

Uh oh!

chen-keinan Apr 18, 2023

Uh oh!

chen-keinan commented Apr 18, 2023

Uh oh!

Uh oh!

feat(scanner): Break out options for enabling libs and policies #1280

feat(scanner): Break out options for enabling libs and policies #1280

Uh oh!

Conversation

simar7 commented Apr 14, 2023

Uh oh!

simar7 commented Apr 14, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chen-keinan commented Apr 18, 2023

Uh oh!

Uh oh!