Skip to content

Commit ab70b2f

Browse files
cx-anurag-dalkecx-anurag-dalke
authored
Merge branch 'main' into adar-cntr-custom-images-dir-fix
2 parents 2fa08d8 + e69df50 commit ab70b2f

File tree

9 files changed

+178
-31
lines changed

9 files changed

+178
-31
lines changed

‎internal/commands/result.go‎

Lines changed: 35 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,7 @@ func NewResultsCommand(
188188
scsScanOverviewWrapper wrappers.ScanOverviewWrapper,
189189
policyWrapper wrappers.PolicyWrapper,
190190
featureFlagsWrapper wrappers.FeatureFlagsWrapper,
191+
jwtWrapper wrappers.JWTWrapper,
191192
) *cobra.Command {
192193
resultCmd := &cobra.Command{
193194
Use: "results",
@@ -201,7 +202,7 @@ func NewResultsCommand(
201202
},
202203
}
203204
showResultCmd := resultShowSubCommand(resultsWrapper, scanWrapper, exportWrapper, resultsPdfReportsWrapper, resultsJSONReportsWrapper,
204-
risksOverviewWrapper, scsScanOverviewWrapper, policyWrapper, featureFlagsWrapper)
205+
risksOverviewWrapper, scsScanOverviewWrapper, policyWrapper, featureFlagsWrapper, jwtWrapper)
205206
codeBashingCmd := resultCodeBashing(codeBashingWrapper)
206207
bflResultCmd := resultBflSubCommand(bflWrapper)
207208
exitCodeSubcommand := exitCodeSubCommand(scanWrapper)
@@ -263,6 +264,7 @@ func resultShowSubCommand(
263264
scsScanOverviewWrapper wrappers.ScanOverviewWrapper,
264265
policyWrapper wrappers.PolicyWrapper,
265266
featureFlagsWrapper wrappers.FeatureFlagsWrapper,
267+
jwtWrapper wrappers.JWTWrapper,
266268
) *cobra.Command {
267269
resultShowCmd := &cobra.Command{
268270
Use: "show",
@@ -273,7 +275,7 @@ func resultShowSubCommand(
273275
$ cx results show --scan-id <scan Id>
274276
`,
275277
),
276-
RunE: runGetResultCommand(resultsWrapper, scanWrapper, exportWrapper, resultsPdfReportsWrapper, resultsJSONReportsWrapper, risksOverviewWrapper, scsScanOverviewWrapper, policyWrapper, featureFlagsWrapper),
278+
RunE: runGetResultCommand(resultsWrapper, scanWrapper, exportWrapper, resultsPdfReportsWrapper, resultsJSONReportsWrapper, risksOverviewWrapper, scsScanOverviewWrapper, policyWrapper, featureFlagsWrapper, jwtWrapper),
277279
}
278280
addScanIDFlag(resultShowCmd, "ID to report on")
279281
addResultFormatFlag(
@@ -309,8 +311,7 @@ func resultShowSubCommand(
309311
commonParams.ResultPolicyDefaultTimeout,
310312
"Cancel the policy evaluation and fail after the timeout in minutes",
311313
)
312-
resultShowCmd.PersistentFlags().Bool(commonParams.IgnorePolicyFlag, false, "Do not evaluate policies")
313-
_ = resultShowCmd.PersistentFlags().MarkHidden(commonParams.IgnorePolicyFlag)
314+
resultShowCmd.PersistentFlags().Bool(commonParams.IgnorePolicyFlag, false, "Skip policy evaluation. Requires override-policy-management permission.")
314315
resultShowCmd.PersistentFlags().Bool(commonParams.SastRedundancyFlag, false,
315316
"Populate SAST results 'data.redundancy' with values '"+fixLabel+"' (to fix) or '"+redundantLabel+"' (no need to fix)")
316317
resultShowCmd.PersistentFlags().Bool(commonParams.ScaHideDevAndTestDepFlag, false, scaHideDevAndTestDepFlagDescription)
@@ -853,7 +854,7 @@ func writeMarkdownSummary(targetFile string, data *wrappers.ResultSummary) error
853854
}
854855

855856
// nolint: whitespace
856-
func writeConsoleSummary(summary *wrappers.ResultSummary, featureFlagsWrapper wrappers.FeatureFlagsWrapper) error {
857+
func writeConsoleSummary(summary *wrappers.ResultSummary, featureFlagsWrapper wrappers.FeatureFlagsWrapper, ignorePolicyFlagOmit bool) error {
857858
if !isScanPending(summary.Status) {
858859
fmt.Printf(" Scan Summary: \n")
859860
fmt.Printf(" Created At: %s\n", summary.CreatedAt)
@@ -865,7 +866,7 @@ func writeConsoleSummary(summary *wrappers.ResultSummary, featureFlagsWrapper wr
865866
summary.RiskMsg,
866867
)
867868
if summary.Policies != nil && !strings.EqualFold(summary.Policies.Status, policeManagementNoneStatus) {
868-
printPoliciesSummary(summary)
869+
printPoliciesSummary(summary, ignorePolicyFlagOmit)
869870
}
870871

871872
printResultsSummaryTable(summary)
@@ -886,7 +887,7 @@ func writeConsoleSummary(summary *wrappers.ResultSummary, featureFlagsWrapper wr
886887
return nil
887888
}
888889

889-
func printPoliciesSummary(summary *wrappers.ResultSummary) {
890+
func printPoliciesSummary(summary *wrappers.ResultSummary, ignorePolicyFlagOmit bool) {
890891
hasViolations := false
891892
for _, policy := range summary.Policies.Policies {
892893
if len(policy.RulesViolated) > 0 {
@@ -896,6 +897,9 @@ func printPoliciesSummary(summary *wrappers.ResultSummary) {
896897
}
897898
if hasViolations {
898899
fmt.Printf(tableLine + "\n")
900+
if ignorePolicyFlagOmit {
901+
printWarningIfIgnorePolicyOmiited()
902+
}
899903
if summary.Policies.BreakBuild {
900904
fmt.Printf(" Policy Management Violation - Break Build Enabled: \n")
901905
} else {
@@ -1017,6 +1021,7 @@ func runGetResultCommand(
10171021
scsScanOverviewWrapper wrappers.ScanOverviewWrapper,
10181022
policyWrapper wrappers.PolicyWrapper,
10191023
featureFlagsWrapper wrappers.FeatureFlagsWrapper,
1024+
jwtWrapper wrappers.JWTWrapper,
10201025
) func(cmd *cobra.Command, args []string) error {
10211026
return func(cmd *cobra.Command, args []string) error {
10221027
targetFile, _ := cmd.Flags().GetString(commonParams.TargetFlag)
@@ -1028,6 +1033,19 @@ func runGetResultCommand(
10281033
sastRedundancy, _ := cmd.Flags().GetBool(commonParams.SastRedundancyFlag)
10291034
agent, _ := cmd.Flags().GetString(commonParams.AgentFlag)
10301035
scaHideDevAndTestDep, _ := cmd.Flags().GetBool(commonParams.ScaHideDevAndTestDepFlag)
1036+
ignorePolicy, _ := cmd.Flags().GetBool(commonParams.IgnorePolicyFlag)
1037+
// Check if the user has permission to override policy management if --ignore-policy is set
1038+
ignorePolicyFlagOmit := false
1039+
if ignorePolicy {
1040+
overridePolicyManagementPer, err := jwtWrapper.CheckPermissionByAccessToken(OverridePolicyManagement)
1041+
if err != nil {
1042+
return err
1043+
}
1044+
if !overridePolicyManagementPer {
1045+
ignorePolicyFlagOmit = true
1046+
ignorePolicy = false
1047+
}
1048+
}
10311049
waitDelay, _ := cmd.Flags().GetInt(commonParams.WaitDelayFlag)
10321050
policyTimeout, _ := cmd.Flags().GetInt(commonParams.PolicyTimeoutFlag)
10331051

@@ -1055,7 +1073,7 @@ func runGetResultCommand(
10551073

10561074
var policyResponseModel *wrappers.PolicyResponseModel
10571075
if !isScanPending(string(scan.Status)) {
1058-
policyResponseModel, err = services.HandlePolicyEvaluation(cmd, policyWrapper, scan, agent, waitDelay, policyTimeout)
1076+
policyResponseModel, err = services.HandlePolicyEvaluation(cmd, policyWrapper, scan, ignorePolicy, agent, waitDelay, policyTimeout)
10591077
if err != nil {
10601078
return err
10611079
}
@@ -1069,7 +1087,7 @@ func runGetResultCommand(
10691087

10701088
_, err = CreateScanReport(resultsWrapper, risksOverviewWrapper, scsScanOverviewWrapper, exportWrapper,
10711089
policyResponseModel, resultsPdfReportsWrapper, resultsJSONReportsWrapper, scan, format, formatPdfToEmail, formatPdfOptions,
1072-
formatSbomOptions, targetFile, targetPath, agent, resultsParams, featureFlagsWrapper)
1090+
formatSbomOptions, targetFile, targetPath, agent, resultsParams, featureFlagsWrapper, ignorePolicyFlagOmit)
10731091
return err
10741092
}
10751093
}
@@ -1176,6 +1194,7 @@ func CreateScanReport(
11761194
agent string,
11771195
resultsParams map[string]string,
11781196
featureFlagsWrapper wrappers.FeatureFlagsWrapper,
1197+
ignorePolicyFlagOmit bool,
11791198
) (*wrappers.ScanResultsCollection, error) {
11801199
reportList := strings.Split(reportTypes, ",")
11811200
results := &wrappers.ScanResultsCollection{}
@@ -1206,7 +1225,7 @@ func CreateScanReport(
12061225
}
12071226
for _, reportType := range reportList {
12081227
err = createReport(reportType, formatPdfToEmail, formatPdfOptions, formatSbomOptions, targetFile,
1209-
targetPath, results, summary, exportWrapper, resultsPdfReportsWrapper, resultsJSONReportsWrapper, featureFlagsWrapper, agent)
1228+
targetPath, results, summary, exportWrapper, resultsPdfReportsWrapper, resultsJSONReportsWrapper, featureFlagsWrapper, ignorePolicyFlagOmit)
12101229
if err != nil {
12111230
return nil, err
12121231
}
@@ -1386,7 +1405,7 @@ func createReport(format,
13861405
resultsPdfReportsWrapper wrappers.ResultsPdfWrapper,
13871406
resultsJSONReportsWrapper wrappers.ResultsJSONWrapper,
13881407
featureFlagsWrapper wrappers.FeatureFlagsWrapper,
1389-
agent string) error {
1408+
ignorePolicyFlagOmit bool) error {
13901409
if printer.IsFormat(format, printer.FormatIndentedJSON) {
13911410
return nil
13921411
}
@@ -1416,7 +1435,7 @@ func createReport(format,
14161435
}
14171436

14181437
if printer.IsFormat(format, printer.FormatSummaryConsole) {
1419-
return writeConsoleSummary(summary, featureFlagsWrapper)
1438+
return writeConsoleSummary(summary, featureFlagsWrapper, ignorePolicyFlagOmit)
14201439
}
14211440
if printer.IsFormat(format, printer.FormatSummary) {
14221441
summaryRpt := createTargetName(targetFile, targetPath, printer.FormatHTML)
@@ -2867,3 +2886,7 @@ type ScannerResponse struct {
28672886
Details string `json:"Details,omitempty"`
28682887
ErrorCode string `json:"ErrorCode,omitempty"`
28692888
}
2889+
2890+
func printWarningIfIgnorePolicyOmiited() {
2891+
fmt.Printf("\n Warning: The --ignore-policy flag was not implemented because you don’t have the required permission.\n Only users with 'override-policy-management' permission can use this flag. \n\n")
2892+
}

‎internal/commands/result_test.go‎

Lines changed: 69 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1314,7 +1314,7 @@ func TestPrintPoliciesSummary_WhenNoRolViolated_ShouldNotContainPolicyViolation(
13141314
old := os.Stdout
13151315
os.Stdout = w
13161316

1317-
printPoliciesSummary(summary)
1317+
printPoliciesSummary(summary, false)
13181318

13191319
w.Close()
13201320
os.Stdout = old
@@ -1629,3 +1629,71 @@ func Test_addPackageInformation_DependencyTypes(t *testing.T) {
16291629
assert.Equal(t, false, testPackage.IsDevelopmentDependency, "Second package should not be marked as development dependency")
16301630
assert.Equal(t, true, testPackage.IsTestDependency, "Second package should be marked as test dependency")
16311631
}
1632+
1633+
func TestIgnorePolicyWithNoPermission(t *testing.T) {
1634+
policyResponseModel := wrappers.PolicyResponseModel{}
1635+
policyResponseModel.BreakBuild = false
1636+
1637+
policy := wrappers.Policy{}
1638+
policy.Name = "MOCK_NAME1"
1639+
policy.RulesViolated = make([]string, 1)
1640+
policy.BreakBuild = true
1641+
policy.Description = "MOCK_DESC1"
1642+
policy.Tags = make([]string, 0)
1643+
1644+
var policies []wrappers.Policy
1645+
policies = append(policies, policy)
1646+
policyResponseModel.Policies = policies
1647+
summary := &wrappers.ResultSummary{
1648+
Policies: &policyResponseModel,
1649+
}
1650+
r, w, _ := os.Pipe()
1651+
old := os.Stdout
1652+
os.Stdout = w
1653+
1654+
printPoliciesSummary(summary, true)
1655+
1656+
w.Close()
1657+
os.Stdout = old
1658+
1659+
var buf bytes.Buffer
1660+
if _, err := io.Copy(&buf, r); err != nil {
1661+
t.Fatalf("failed to copy output: %v", err) // Handle the error if io.Copy fails
1662+
}
1663+
output := buf.String()
1664+
assert.Assert(t, strings.Contains(output, "Warning: The --ignore-policy flag was not implemented because you don’t have the required permission."), "'Ignore Policy flag omitted because you dont have permission' should not be present in the output")
1665+
}
1666+
1667+
func TestIgnorePolicyWithPermission(t *testing.T) {
1668+
policyResponseModel := wrappers.PolicyResponseModel{}
1669+
policyResponseModel.BreakBuild = false
1670+
1671+
policy := wrappers.Policy{}
1672+
policy.Name = "MOCK_NAME2"
1673+
policy.RulesViolated = make([]string, 1)
1674+
policy.BreakBuild = true
1675+
policy.Description = "MOCK_DESC2"
1676+
policy.Tags = make([]string, 0)
1677+
1678+
var policies []wrappers.Policy
1679+
policies = append(policies, policy)
1680+
policyResponseModel.Policies = policies
1681+
summary := &wrappers.ResultSummary{
1682+
Policies: &policyResponseModel,
1683+
}
1684+
r, w, _ := os.Pipe()
1685+
old := os.Stdout
1686+
os.Stdout = w
1687+
1688+
printPoliciesSummary(summary, false)
1689+
1690+
w.Close()
1691+
os.Stdout = old
1692+
1693+
var buf bytes.Buffer
1694+
if _, err := io.Copy(&buf, r); err != nil {
1695+
t.Fatalf("failed to copy output: %v", err) // Handle the error if io.Copy fails
1696+
}
1697+
output := buf.String()
1698+
assert.Assert(t, !strings.Contains(output, "Warning: The --ignore-policy flag was not implemented because you don’t have the required permission."), "'Ignore Policy flag omitted because you dont have permission' should not be present in the output")
1699+
}

‎internal/commands/root.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,7 @@ func NewAstCLI(
195195
scsScanOverviewWrapper,
196196
policyWrapper,
197197
featureFlagsWrapper,
198+
jwtWrapper,
198199
)
199200

200201
versionCmd := util.NewVersionCommand()

0 commit comments

Comments
 (0)