diff --git a/package-lock.json b/package-lock.json index 9019397c66..3af014d5ae 100644 --- a/package-lock.json +++ b/package-lock.json @@ -13,7 +13,7 @@ "packages/*" ], "dependencies": { - "@open-policy-agent/opa-wasm": "^1.2.0", + "@open-policy-agent/opa-wasm": "^1.6.0", "@snyk/cli-interface": "2.11.0", "@snyk/cloud-config-parser": "^1.12.0", "@snyk/code-client": "^4.5.0", @@ -4762,12 +4762,12 @@ } }, "node_modules/@open-policy-agent/opa-wasm": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/@open-policy-agent/opa-wasm/-/opa-wasm-1.2.0.tgz", - "integrity": "sha512-CtUBTnzvDrT0NASa8IuGQTxFGgt2vxbLnMYuTA+uDFxOcA4uK4mGFgrhHJtxUZnWHiwemOvKKSY3BMCo7qiAsQ==", + "version": "1.6.0", + "resolved": "https://registry.npmjs.org/@open-policy-agent/opa-wasm/-/opa-wasm-1.6.0.tgz", + "integrity": "sha512-62FyUuG6NcJ21GPf6e9QU8NZxh1mGTELQB1olo07VEGQDPt7XHiuwtVOCwJtGme62K16n+lImCna+LJX+1ZBvQ==", "dependencies": { "sprintf-js": "^1.1.2", - "utf8": "^3.0.0" + "yaml": "^1.10.2" } }, "node_modules/@pagerduty/pdjs": { @@ -25501,11 +25501,6 @@ "node": ">=0.10.0" } }, - "node_modules/utf8": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/utf8/-/utf8-3.0.0.tgz", - "integrity": "sha512-E8VjFIQ/TyQgp+TZfS6l8yp/xWppSAHzidGiRrqe4bK4XP9pTRyKFgGJpO3SN7zdX4DeomTrwaseCHovfpFcqQ==" - }, "node_modules/util-deprecate": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz", @@ -30466,12 +30461,12 @@ "dev": true }, "@open-policy-agent/opa-wasm": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/@open-policy-agent/opa-wasm/-/opa-wasm-1.2.0.tgz", - "integrity": "sha512-CtUBTnzvDrT0NASa8IuGQTxFGgt2vxbLnMYuTA+uDFxOcA4uK4mGFgrhHJtxUZnWHiwemOvKKSY3BMCo7qiAsQ==", + "version": "1.6.0", + "resolved": "https://registry.npmjs.org/@open-policy-agent/opa-wasm/-/opa-wasm-1.6.0.tgz", + "integrity": "sha512-62FyUuG6NcJ21GPf6e9QU8NZxh1mGTELQB1olo07VEGQDPt7XHiuwtVOCwJtGme62K16n+lImCna+LJX+1ZBvQ==", "requires": { "sprintf-js": "^1.1.2", - "utf8": "^3.0.0" + "yaml": "^1.10.2" } }, "@pagerduty/pdjs": { @@ -44411,7 +44406,7 @@ "snyk": { "version": "file:", "requires": { - "@open-policy-agent/opa-wasm": "^1.2.0", + "@open-policy-agent/opa-wasm": "1.6.0", "@snyk/cli-alert": "file:packages/cli-alert", "@snyk/cli-interface": "2.11.0", "@snyk/cloud-config-parser": "^1.12.0", @@ -48281,12 +48276,12 @@ "dev": true }, "@open-policy-agent/opa-wasm": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/@open-policy-agent/opa-wasm/-/opa-wasm-1.2.0.tgz", - "integrity": "sha512-CtUBTnzvDrT0NASa8IuGQTxFGgt2vxbLnMYuTA+uDFxOcA4uK4mGFgrhHJtxUZnWHiwemOvKKSY3BMCo7qiAsQ==", + "version": "1.6.0", + "resolved": "https://registry.npmjs.org/@open-policy-agent/opa-wasm/-/opa-wasm-1.6.0.tgz", + "integrity": "sha512-62FyUuG6NcJ21GPf6e9QU8NZxh1mGTELQB1olo07VEGQDPt7XHiuwtVOCwJtGme62K16n+lImCna+LJX+1ZBvQ==", "requires": { "sprintf-js": "^1.1.2", - "utf8": "^3.0.0" + "yaml": "^1.10.2" } }, "@pagerduty/pdjs": { @@ -64766,11 +64761,6 @@ "integrity": "sha512-cwESVXlO3url9YWlFW/TA9cshCEhtu7IKJ/p5soJ/gGpj7vbvFrAY/eIioQ6Dw23KjZhYgiIo8HOs1nQ2vr/oQ==", "dev": true }, - "utf8": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/utf8/-/utf8-3.0.0.tgz", - "integrity": "sha512-E8VjFIQ/TyQgp+TZfS6l8yp/xWppSAHzidGiRrqe4bK4XP9pTRyKFgGJpO3SN7zdX4DeomTrwaseCHovfpFcqQ==" - }, "util-deprecate": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz", @@ -68125,11 +68115,6 @@ "integrity": "sha512-cwESVXlO3url9YWlFW/TA9cshCEhtu7IKJ/p5soJ/gGpj7vbvFrAY/eIioQ6Dw23KjZhYgiIo8HOs1nQ2vr/oQ==", "dev": true }, - "utf8": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/utf8/-/utf8-3.0.0.tgz", - "integrity": "sha512-E8VjFIQ/TyQgp+TZfS6l8yp/xWppSAHzidGiRrqe4bK4XP9pTRyKFgGJpO3SN7zdX4DeomTrwaseCHovfpFcqQ==" - }, "util-deprecate": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz", diff --git a/package.json b/package.json index 07833e171d..2ac4aa2914 100644 --- a/package.json +++ b/package.json @@ -68,7 +68,7 @@ "author": "snyk.io", "license": "Apache-2.0", "dependencies": { - "@open-policy-agent/opa-wasm": "^1.2.0", + "@open-policy-agent/opa-wasm": "^1.6.0", "@snyk/cli-interface": "2.11.0", "@snyk/cloud-config-parser": "^1.12.0", "@snyk/code-client": "^4.5.0", diff --git a/test/fixtures/iac/custom-rules/custom.tar.gz b/test/fixtures/iac/custom-rules/custom.tar.gz index 9b786a2d0a..8655826a22 100644 Binary files a/test/fixtures/iac/custom-rules/custom.tar.gz and b/test/fixtures/iac/custom-rules/custom.tar.gz differ diff --git a/test/jest/acceptance/iac/custom-rules.spec.ts b/test/jest/acceptance/iac/custom-rules.spec.ts index b6df847eb1..d6017da563 100644 --- a/test/jest/acceptance/iac/custom-rules.spec.ts +++ b/test/jest/acceptance/iac/custom-rules.spec.ts @@ -29,7 +29,7 @@ describe('iac test --rules', () => { expect(stdout).toContain('Testing ./iac/terraform/sg_open_ssh.tf'); expect(stdout).toContain('Infrastructure as code issues:'); expect(stdout).toContain('Missing tags'); - expect(stdout).toContain('CUSTOM-123'); + expect(stdout).toContain('CUSTOM-1'); expect(stdout).toContain( 'introduced by input > resource > aws_security_group[allow_ssh] > tags', ); diff --git a/test/jest/unit/iac-unit-tests/file-scanner.spec.ts b/test/jest/unit/iac-unit-tests/file-scanner.spec.ts index efb6cea648..ef60bbbd2f 100644 --- a/test/jest/unit/iac-unit-tests/file-scanner.spec.ts +++ b/test/jest/unit/iac-unit-tests/file-scanner.spec.ts @@ -1,11 +1,13 @@ -import * as mockFs from 'mock-fs'; import * as path from 'path'; import { scanFiles, clearPolicyEngineCache, } from '../../../../src/cli/commands/test/iac-local-execution/file-scanner'; import { LOCAL_POLICY_ENGINE_DIR } from '../../../../src/cli/commands/test/iac-local-execution/local-cache'; -import { IacFileParsed } from '../../../../src/cli/commands/test/iac-local-execution/types'; +import { + EngineType, + IacFileParsed, +} from '../../../../src/cli/commands/test/iac-local-execution/types'; import { paresdKubernetesFileStub, @@ -15,6 +17,7 @@ import { expectedViolatedPoliciesForTerraform, expectedViolatedPoliciesForArm, } from './file-scanner.fixtures'; +import * as localCacheModule from '../../../../src/cli/commands/test/iac-local-execution/local-cache'; describe('scanFiles', () => { const parsedFiles: Array = [ @@ -24,23 +27,48 @@ describe('scanFiles', () => { ]; afterEach(() => { - mockFs.restore(); clearPolicyEngineCache(); }); describe('with parsed files', () => { it('returns the expected violated policies', async () => { - mockFs({ - [path.resolve( - __dirname, - path.join('../../../..', LOCAL_POLICY_ENGINE_DIR), - )]: mockFs.load( - path.resolve( - __dirname, - path.join('../../../smoke', LOCAL_POLICY_ENGINE_DIR), - ), - ), - }); + const policyEngineCoreDataPath = path.resolve( + __dirname, + path.join('../../../smoke', LOCAL_POLICY_ENGINE_DIR), + ); + const policyEngineMetaDataPath = path.resolve( + __dirname, + path.join('../../../smoke', LOCAL_POLICY_ENGINE_DIR), + ); + + const spy = jest + .spyOn(localCacheModule, 'getLocalCachePath') + .mockImplementation((engineType: EngineType) => { + switch (engineType) { + case EngineType.Kubernetes: + return [ + `${policyEngineCoreDataPath}/k8s_policy.wasm`, + `${policyEngineMetaDataPath}/k8s_data.json`, + ]; + case EngineType.Terraform: + return [ + `${policyEngineCoreDataPath}/tf_policy.wasm`, + `${policyEngineMetaDataPath}/tf_data.json`, + ]; + case EngineType.CloudFormation: + return [ + `${policyEngineCoreDataPath}/cloudformation_policy.wasm`, + `${policyEngineMetaDataPath}/cloudformation_data.json`, + ]; + case EngineType.ARM: + return [ + `${policyEngineCoreDataPath}/arm_policy.wasm`, + `${policyEngineMetaDataPath}/arm_data.json`, + ]; + default: + return []; + } + }); const scanResults = await scanFiles(parsedFiles); expect(scanResults[0].violatedPolicies).toEqual( @@ -52,20 +80,13 @@ describe('scanFiles', () => { expect(scanResults[2].violatedPolicies).toEqual( expectedViolatedPoliciesForArm, ); + spy.mockReset(); }); - // TODO: Extract policy engine & the cache mechanism, test them separately. }); describe('missing policy engine wasm files', () => { it('throws an error', async () => { - mockFs({ - [path.resolve( - __dirname, - path.join('../../../..', LOCAL_POLICY_ENGINE_DIR), - )]: {}, - }); - await expect(scanFiles(parsedFiles)).rejects.toThrow(); }); });