Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add exclude severities functionality #111

Merged
merged 15 commits into from
Sep 15, 2021
Merged

Add exclude severities functionality #111

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
55e63c6
Update primary components
JonZeolla Sep 1, 2021
0bde704
Kics changed an argument again
JonZeolla Sep 1, 2021
5547a40
Merge branch 'main' into 2021-09-update-components
JonZeolla Sep 1, 2021
423d1fe
Add exclude results functionality; needs tests
JonZeolla Aug 31, 2021
d23e523
Exit code changed
JonZeolla Sep 2, 2021
ac3272e
Cleanup mess
JonZeolla Sep 2, 2021
2207177
Revert "Exit code changed"
JonZeolla Sep 2, 2021
1b24f5a
Merge branch 'main' into add-exclude-severities
JonZeolla Sep 3, 2021
4843ef9
Fixes
JonZeolla Sep 3, 2021
2265bca
Remove manually installed pyyaml type hints
JonZeolla Sep 7, 2021
01eb039
Merge branch 'main' into add-exclude-severities
JonZeolla Sep 13, 2021
bfac9be
Fix exit code for tests
JonZeolla Sep 13, 2021
fe84350
Fix typo
JonZeolla Sep 14, 2021
6e3b3bd
RST formatting fix
JonZeolla Sep 14, 2021
2787b6c
Add consistency
JonZeolla Sep 14, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion Pipfile.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

15 changes: 9 additions & 6 deletions docs/Ansible/index.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,16 +30,19 @@ a pipeline action on commit or pull request::
Customizing KICS
^^^^^^^^^^^^^^^^

+----------------------+-------------------------------------------+-------------------------------------------------------------------------------+
| Environment variable | Result | Example |
+======================+===========================================+===============================================================================+
| ``KICS_QUERIES`` | Passes the value to ``--include-queries`` | ``c3b9f7b0-f5a0-49ec-9cbc-f1e346b7274d,7dfb316c-a6c2-454d-b8a2-97f147b0c0ff`` |
+----------------------+-------------------------------------------+-------------------------------------------------------------------------------+
+-----------------------------+----------------------------------------------+-------------------------------------------------------------------------------+
| Environment variable | Result | Example |
+=============================+==============================================+===============================================================================+
| ``KICS_QUERIES`` | Passes the value to ``--include-queries`` | ``c3b9f7b0-f5a0-49ec-9cbc-f1e346b7274d,7dfb316c-a6c2-454d-b8a2-97f147b0c0ff`` |
+-----------------------------+----------------------------------------------+-------------------------------------------------------------------------------+
| ``KICS_EXCLUDE_SEVERITIES`` | Passes the value to ``--exclude-severities`` | ``info,low`` |
+-----------------------------+----------------------------------------------+-------------------------------------------------------------------------------+

::

KICS_QUERIES=c3b9f7b0-f5a0-49ec-9cbc-f1e346b7274d,7dfb316c-a6c2-454d-b8a2-97f147b0c0ff
docker run --env-file <(env | grep KICS_QUERIES) -v $(pwd):/iac easy_infra:latest-minimal ansible-playbook EXAMPLE.yml --check
KICS_EXCLUDE_SEVERITIES=info,low
docker run --env-file <(env | grep ^KICS_) -v $(pwd):/iac easy_infra:latest-minimal ansible-playbook EXAMPLE.yml --check

Disabling Security
^^^^^^^^^^^^^^^^^^
Expand Down
16 changes: 10 additions & 6 deletions docs/Terraform/index.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,16 +41,20 @@ plan`` and ``terraform deploy``::
Customizing KICS
^^^^^^^^^^^^^^^^

+----------------------+-------------------------------------------+-------------------------------------------------------------------------------+
| Environment variable | Result | Example |
+======================+===========================================+===============================================================================+
| ``KICS_QUERIES`` | Passes the value to ``--include-queries`` | ``4728cd65-a20c-49da-8b31-9c08b423e4db,46883ce1-dc3e-4b17-9195-c6a601624c73`` |
+----------------------+-------------------------------------------+-------------------------------------------------------------------------------+
+-----------------------------+----------------------------------------------+-------------------------------------------------------------------------------+
| Environment variable | Result | Example |
+=============================+==============================================+===============================================================================+
| ``KICS_QUERIES`` | Passes the value to ``--include-queries`` | ``4728cd65-a20c-49da-8b31-9c08b423e4db,46883ce1-dc3e-4b17-9195-c6a601624c73`` |
+-----------------------------+----------------------------------------------+-------------------------------------------------------------------------------+
| ``KICS_EXCLUDE_SEVERITIES`` | Passes the value to ``--exclude-severities`` | ``info,low`` |
+-----------------------------+----------------------------------------------+-------------------------------------------------------------------------------+


::

KICS_QUERIES=4728cd65-a20c-49da-8b31-9c08b423e4db,46883ce1-dc3e-4b17-9195-c6a601624c73
docker run --env-file <(env | grep KICS_QUERIES) -v $(pwd):/iac easy_infra:latest-minimal terraform validate
KICS_EXCLUDE_SEVERITIES=info,low
docker run --env-file <(env | grep ^KICS_) -v $(pwd):/iac easy_infra:latest-minimal terraform validate

Terraform Caching
^^^^^^^^^^^^^^^^^
Expand Down
2 changes: 2 additions & 0 deletions easy_infra.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ _anchors:
--output-name kics --path .
customizations:
KICS_QUERIES: --include-queries
KICS_EXCLUDE_SEVERITIES: --exclude-severities
description: directory scan
terrascan:
command: terrascan scan -i terraform -t all -d .
Expand All @@ -33,6 +34,7 @@ commands:
--output-name kics --path .
customizations:
KICS_QUERIES: --include-queries
KICS_EXCLUDE_SEVERITIES: --exclude-severities
description: directory scan
version: 2.9.6+dfsg-1
version_argument: --version
Expand Down
51 changes: 50 additions & 1 deletion tests/test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -321,6 +321,11 @@ def run_terraform(*, image: str, final: bool = False):
"terraform init",
0,
),
(
{"KICS_EXCLUDE_SEVERITIES": "info"},
"terraform validate",
0,
),
]

LOG.debug("Testing secure terraform configurations")
Expand Down Expand Up @@ -482,6 +487,31 @@ def run_terraform(*, image: str, final: bool = False):
'/usr/bin/env bash -c "KICS_QUERIES=5a2486aa-facf-477d-a5c1-b010789459ce terraform --skip-tfsec --skip-terrascan --skip-checkov validate"',
50,
),
(
{
"SKIP_CHECKOV": "true",
"SKIP_TFSEC": "true",
"SKIP_TERRASCAN": "true",
"KICS_EXCLUDE_SEVERITIES": "medium",
},
"terraform validate",
50,
), # Doesn't exclude high
(
{
"SKIP_CHECKOV": "true",
"SKIP_TFSEC": "true",
"SKIP_TERRASCAN": "true",
"KICS_EXCLUDE_SEVERITIES": "info,low,medium,high",
},
"terraform validate",
0,
), # Excludes all the severities
(
{},
'/usr/bin/env bash -c "KICS_EXCLUDE_SEVERITIES=info,low,medium,high terraform --skip-tfsec --skip-terrascan --skip-checkov validate"',
0,
), # Excludes all the severities
]

num_tests_ran += exec_tests(tests=tests, volumes=kics_volumes, image=image)
Expand Down Expand Up @@ -881,9 +911,28 @@ def run_ansible(*, image: str):
),
(
{},
"/usr/bin/env bash -c 'KICS_QUERIES=7dfb316c-a6c2-454d-b8a2-97f147b0c0ff ansible-playbook insecure.yml --check'",
'/usr/bin/env bash -c "KICS_QUERIES=7dfb316c-a6c2-454d-b8a2-97f147b0c0ff ansible-playbook insecure.yml --check"',
50,
),
(
{
"KICS_EXCLUDE_SEVERITIES": "info,low",
},
"ansible-playbook insecure.yml --check",
50,
), # Doesn't exclude high or medium
(
{
"KICS_EXCLUDE_SEVERITIES": "high,medium",
},
"ansible-playbook insecure.yml --check",
4,
), # Excludes all the relevant severities, exits 4 because insecure.yml is not a valid Play
(
{},
'/usr/bin/env bash -c "KICS_EXCLUDE_SEVERITIES=info,low,medium,high ansible-playbook insecure.yml --check"',
4,
), # Excludes all the severities, exits 4 because insecure.yml is not a valid Play
]

num_tests_ran += exec_tests(tests=tests, volumes=kics_volumes, image=image)
Expand Down