update(resolver): implemented limit in resolver to 50 files

internal/constants/constants.go

@@ -116,6 +116,9 @@ const (
 
 	// LogFormatPretty - print log more readable
 	LogFormatPretty = "pretty"
+
+	// MaxResolvedFiles - max files kics will resolve to prevent circular cycles
+	MaxResolvedFiles = 50
 )
 
 // GetRelease - returns the current release in the format 'kics@version' to be used by sentry

pkg/detector/default_detect.go

@@ -37,7 +37,7 @@ func (d defaultDetectLine) DetectLine(file *model.FileMetadata, searchKey string
 	for _, key := range strings.Split(sanitizedSubstring, ".") {
 		substr1, substr2 := GenerateSubstrings(key, extractedString)
 
-		detector = detector.DetectCurrentLine(substr1, substr2)
+		detector = detector.DetectCurrentLine(substr1, substr2, 0)
 
 		if detector.IsBreak {
 			break

pkg/detector/docker/docker_detect.go

@@ -46,7 +46,7 @@ func (d DetectKindLine) DetectLine(file *model.FileMetadata, searchKey string,
 	for _, key := range strings.Split(sKey, ".") {
 		substr1, substr2 := detector.GenerateSubstrings(key, extractedString)
 
-		det = det.DetectCurrentLine(substr1, substr2)
+		det = det.DetectCurrentLine(substr1, substr2, 0)
 
 		if det.IsBreak {
 			break

pkg/detector/helper.go

@@ -252,11 +252,11 @@ func removeExtras(result string, start, end int) string {
 }
 
 // DetectCurrentLine uses levenshtein distance to find the most accurate line for the vulnerability
-func (d *DefaultDetectLineResponse) DetectCurrentLine(str1, str2 string) *DefaultDetectLineResponse {
+func (d *DefaultDetectLineResponse) DetectCurrentLine(str1, str2 string, recurseCount int) *DefaultDetectLineResponse {
 	distances := make(map[int]int)
 
 	for i := d.CurrentLine; i < len(d.Lines); i++ {
-		if res := d.checkResolvedFile(d.Lines[i], str1, str2); res.FoundAtLeastOne {
+		if res := d.checkResolvedFile(d.Lines[i], str1, str2, recurseCount); res.FoundAtLeastOne {
 			return res
 		}
 		distances = d.checkLine(str1, str2, distances, i)
@@ -297,10 +297,13 @@ func (d *DefaultDetectLineResponse) checkLine(str1, str2 string, distances map[i
 	return distances
 }
 
-func (d *DefaultDetectLineResponse) checkResolvedFile(line, str1, st2 string) *DefaultDetectLineResponse {
+func (d *DefaultDetectLineResponse) checkResolvedFile(line, str1, st2 string, recurseCount int) *DefaultDetectLineResponse {
 	for key, r := range d.ResolvedFiles {
 		if strings.Contains(line, key) {
-			return d.restore(r.Lines, r.Path).DetectCurrentLine(str1, st2)
+			if recurseCount > constants.MaxResolvedFiles {
+				break
+			}
+			return d.restore(r.Lines, r.Path).DetectCurrentLine(str1, st2, recurseCount+1)
 		}
 	}
 	return &DefaultDetectLineResponse{

pkg/detector/helper_test.go

@@ -492,7 +492,7 @@ func TestDefaultDetectLineResponse_checkResolvedFile(t *testing.T) {
 				ResolvedFile:    tt.fields.ResolvedFile,
 				ResolvedFiles:   tt.fields.ResolvedFiles,
 			}
-			if got := d.checkResolvedFile(tt.args.line, tt.args.str1, tt.args.st2); !reflect.DeepEqual(got, tt.want) {
+			if got := d.checkResolvedFile(tt.args.line, tt.args.str1, tt.args.st2, 0); !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("checkResolvedFile() = %v, want %v", got, tt.want)
 			}
 		})

pkg/engine/vulnerability_utils.go

@@ -7,6 +7,7 @@ import (
 
 	dec "github.com/Checkmarx/kics/pkg/detector"
 	"github.com/Checkmarx/kics/pkg/model"
+	"github.com/Checkmarx/kics/pkg/utils"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 )
@@ -37,36 +38,30 @@ func (s *searchLineCalculator) calculate() {
 		}
 	}
 }
-
 func mergeWithMetadata(base, additional map[string]interface{}) map[string]interface{} {
 	for k, v := range additional {
 		if _, ok := base[k]; ok {
 			continue
 		}
-
 		base[k] = v
 	}
-
 	return base
 }
-
 func mustMapKeyToString(m map[string]interface{}, key string) *string {
 	res, err := mapKeyToString(m, key, true)
-	if err != nil && key != "value" {
+	excludedFields := []string{"value", "resourceName", "resourceType"}
+	if err != nil && !utils.Contains(key, excludedFields) {
 		log.Warn().
 			Str("reason", err.Error()).
 			Msgf("Failed to get key %s in map", key)
 	}
-
 	return res
 }
-
 func mapKeyToString(m map[string]interface{}, key string, allowNil bool) (*string, error) {
 	v, ok := m[key]
 	if !ok {
 		return nil, fmt.Errorf("key '%s' not found in map", key)
 	}
-
 	switch vv := v.(type) {
 	case json.Number:
 		return stringToPtrString(vv.String()), nil
@@ -86,17 +81,13 @@ func mapKeyToString(m map[string]interface{}, key string, allowNil bool) (*strin
 	case bool:
 		return stringToPtrString(fmt.Sprintf("%v", vv)), nil
 	}
-
 	log.Debug().
 		Msg("Detecting line. can't format item to string")
-
 	if allowNil {
 		return nil, nil
 	}
-
 	return stringToPtrString(""), nil
 }
-
 func stringToPtrString(v string) *string {
 	return &v
 }
@@ -108,7 +99,6 @@ func PtrStringToString(v *string) string {
 	}
 	return *v
 }
-
 func tryOverride(overrideKey, vulnParam string, vObj map[string]interface{}) *string {
 	if overrideKey != "" {
 		if override, ok := vObj["override"].(map[string]interface{}); ok {
@@ -126,7 +116,6 @@ func tryOverride(overrideKey, vulnParam string, vObj map[string]interface{}) *st
 	}
 	return nil
 }
-
 func getStringFromMap(vulnParam, defaultParam, overrideKey string, vObj map[string]interface{}, logWithFields *zerolog.Logger) string {
 	ts, err := mapKeyToString(vObj, vulnParam, false)
 	if err != nil {
@@ -140,7 +129,6 @@ func getStringFromMap(vulnParam, defaultParam, overrideKey string, vObj map[stri
 	}
 	return *ts
 }
-
 func getSeverity(severity string) model.Severity {
 	for _, si := range model.AllSeverities {
 		if severity == string(si) {

pkg/parser/json/parser.go

@@ -19,7 +19,7 @@ type Parser struct {
 func (p *Parser) Resolve(fileContent []byte, filename string) ([]byte, error) {
 	// Resolve files passed as arguments with file resolver (e.g. file://)
 	res := file.NewResolver(json.Unmarshal, json.Marshal)
-	resolved := res.Resolve(fileContent, filename)
+	resolved := res.Resolve(fileContent, filename, 0)
 	p.resolvedFiles = res.ResolvedFiles
 	if len(res.ResolvedFiles) == 0 {
 		return fileContent, nil

pkg/parser/yaml/parser.go

@@ -21,7 +21,7 @@ type Parser struct {
 func (p *Parser) Resolve(fileContent []byte, filename string) ([]byte, error) {
 	// Resolve files passed as arguments with file resolver (e.g. file://)
 	res := file.NewResolver(yaml.Unmarshal, yaml.Marshal)
-	resolved := res.Resolve(fileContent, filename)
+	resolved := res.Resolve(fileContent, filename, 0)
 	p.resolvedFiles = res.ResolvedFiles
 	if len(res.ResolvedFiles) == 0 {
 		return fileContent, nil

pkg/resolver/file/file.go

@@ -6,6 +6,8 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/Checkmarx/kics/internal/constants"
+
 	"github.com/Checkmarx/kics/pkg/model"
 	"github.com/rs/zerolog/log"
 )
@@ -29,15 +31,15 @@ func NewResolver(
 }
 
 // Resolve - replace or modifies in-memory content before parsing
-func (r *Resolver) Resolve(fileContent []byte, path string) []byte {
+func (r *Resolver) Resolve(fileContent []byte, path string, resolveCount int) []byte {
 	var obj any
 	err := r.unmarshler(fileContent, &obj)
 	if err != nil {
 		return fileContent
 	}
 
 	// resolve the paths
-	obj, _ = r.walk(obj, path)
+	obj, _ = r.walk(obj, path, resolveCount)
 
 	b, err := r.marshler(obj)
 	if err != nil {
@@ -47,26 +49,26 @@ func (r *Resolver) Resolve(fileContent []byte, path string) []byte {
 	return b
 }
 
-func (r *Resolver) walk(value any, path string) (any, bool) {
+func (r *Resolver) walk(value any, path string, resolveCount int) (any, bool) {
 	// go over the value and replace paths with the real content
 	switch typedValue := value.(type) {
 	case string:
-		return r.resolvePath(typedValue, path)
+		return r.resolvePath(typedValue, path, resolveCount)
 	case []any:
 		for i, v := range typedValue {
-			typedValue[i], _ = r.walk(v, path)
+			typedValue[i], _ = r.walk(v, path, resolveCount)
 		}
 		return typedValue, false
 	case map[string]any:
-		return r.handleMap(typedValue, path)
+		return r.handleMap(typedValue, path, resolveCount)
 	default:
 		return value, false
 	}
 }
 
-func (r *Resolver) handleMap(value map[string]interface{}, path string) (any, bool) {
+func (r *Resolver) handleMap(value map[string]interface{}, path string, resolveCount int) (any, bool) {
 	for k, v := range value {
-		val, res := r.walk(v, path)
+		val, res := r.walk(v, path, resolveCount)
 		// check if it is a ref than everything needs to be changed
 		if res && strings.Contains(strings.ToLower(k), "ref") {
 			return val, false
@@ -77,7 +79,10 @@ func (r *Resolver) handleMap(value map[string]interface{}, path string) (any, bo
 }
 
 // isPath returns true if the value is a valid path
-func (r *Resolver) resolvePath(value, filePath string) (any, bool) {
+func (r *Resolver) resolvePath(value, filePath string, resolveCount int) (any, bool) {
+	if resolveCount > constants.MaxResolvedFiles {
+		return value, false
+	}
 	path := filepath.Join(filepath.Dir(filePath), value)
 	_, err := os.Stat(path)
 	if err != nil {
@@ -103,7 +108,7 @@ func (r *Resolver) resolvePath(value, filePath string) (any, bool) {
 		return value, false
 	}
 
-	resolvedFile := r.Resolve(fileContent, path)
+	resolvedFile := r.Resolve(fileContent, path, resolveCount+1)
 
 	// parse the content
 	var obj any

pkg/resolver/file/file_test.go

@@ -69,7 +69,7 @@ func TestResolver_Resolve(t *testing.T) {
 				t.Fatal(err)
 			}
 
-			if got := r.Resolve(cont, tt.args.path); !reflect.DeepEqual(prepareString(string(got)), prepareString(string(tt.want))) {
+			if got := r.Resolve(cont, tt.args.path, 0); !reflect.DeepEqual(prepareString(string(got)), prepareString(string(tt.want))) {
 				t.Errorf("Resolve() = %v, want = %v", prepareString(string(got)), prepareString(string(tt.want)))
 			}
 		})