diff --git a/pkg/scanners/terraform/parser/resolvers/cache.go b/pkg/scanners/terraform/parser/resolvers/cache.go index d15b6c87626a..78d2e2cc4f59 100644 --- a/pkg/scanners/terraform/parser/resolvers/cache.go +++ b/pkg/scanners/terraform/parser/resolvers/cache.go @@ -7,8 +7,6 @@ import ( "io/fs" "os" "path/filepath" - - "golang.org/x/sys/unix" ) type cacheResolver struct{} @@ -43,17 +41,13 @@ func cacheDir() string { if err := os.MkdirAll(attempt, 0o755); err != nil { continue } - if writable(attempt) { + if isWritable(attempt) { return attempt } } return "" } -func writable(path string) bool { - return unix.Access(path, unix.W_OK) == nil -} - func (r *cacheResolver) Resolve(_ context.Context, _ fs.FS, opt Options) (filesystem fs.FS, prefix string, downloadPath string, applies bool, err error) { if !opt.AllowCache { opt.Debug("Cache is disabled.") diff --git a/pkg/scanners/terraform/parser/resolvers/writable.go b/pkg/scanners/terraform/parser/resolvers/writable.go new file mode 100644 index 000000000000..84f471f779c2 --- /dev/null +++ b/pkg/scanners/terraform/parser/resolvers/writable.go @@ -0,0 +1,36 @@ +//go:build !windows +// +build !windows + +package resolvers + +import ( + "os" + "syscall" +) + +func isWritable(path string) bool { + info, err := os.Stat(path) + if err != nil { + return false + } + + if !info.IsDir() { + return false + } + + // Check if the user bit is enabled in file permission + if info.Mode().Perm()&(1<<(uint(7))) == 0 { + return false + } + + var stat syscall.Stat_t + if err = syscall.Stat(path, &stat); err != nil { + return false + } + + if uint32(os.Geteuid()) != stat.Uid { + return false + } + + return true +} diff --git a/pkg/scanners/terraform/parser/resolvers/writable_windows.go b/pkg/scanners/terraform/parser/resolvers/writable_windows.go new file mode 100644 index 000000000000..69cb3c7169b1 --- /dev/null +++ b/pkg/scanners/terraform/parser/resolvers/writable_windows.go @@ -0,0 +1,24 @@ +package resolvers + +import ( + "os" +) + +func isWritable(path string) bool { + + info, err := os.Stat(path) + if err != nil { + return false + } + + if !info.IsDir() { + return false + } + + // Check if the user bit is enabled in file permission + if info.Mode().Perm()&(1<<(uint(7))) == 0 { + return false + } + + return true +}