Merge branch 'master' into refactorTFDescriptioURLs

.github/scripts/docs-generator/query-page-generator/query-page-generator.py

@@ -138,7 +138,7 @@ def format_positive_tests(positive_tests : dict) -> str:
     for idx, x in enumerate(positive_tests):
         filename = x.get('fileName')
         extension = filename.split(".")[-1]
-        title = f'Postitive test num. {idx + 1} - {extension} file'
+        title = f'Positive test num. {idx + 1} - {extension} file'
         code = x.get('code')
 
         results_lines = ''

.github/scripts/kics-queries-repo-branch-creation/config-template/config.yml

@@ -0,0 +1,70 @@
+version: 2.1
+orbs:
+  gh: circleci/[email protected]
+executors:
+  circle-machine:
+    machine:
+      image: ubuntu-2004:2023.04.2
+  cimg-base:
+    docker:
+      - image: cimg/base:2022.11
+    resource_class: small
+
+jobs:
+  publish-github-release-and-images:
+    executor: circle-machine
+    working_directory: ~/repo
+    steps:
+      - run:
+          name: Config git and clone kics-queries-repo
+          command: |
+            git config --global url."https://${GITHUB_USER}:${GITHUB_TOKEN}@github.com".insteadOf "https://github.com"
+            git clone https://github.com/CheckmarxDev/kics-queries-repo.git full_repo
+      - run:
+          name: Configure tools worktree
+          command: |
+            cd full_repo
+            git worktree add ../main main
+            cd ..
+      - run:
+          name: Set variables
+          command: |
+            echo "branch_name_template_to_replace" >> main/releaseBranches.txt
+            main/scripts/setVariables.sh
+            source "$BASH_ENV"
+      - run:
+          name: Build kics-queries-repo tar.gz
+          command: |
+            main/scripts/createQueriesRepo.sh "$PWD/full_repo" queries.tar.gz
+      - run:
+          name: Create GitHub release
+          command: |
+            main/scripts/createRelease.sh
+      - run:
+          name: Build ast-data image
+          command: |
+            main/scripts/buildImages.sh
+      - run:
+          name: Push ast-data image (JFrog Artifactory) 
+          command: |
+            main/scripts/pushImageJFrog.sh
+      - run:
+          name: Persist AST_DATA_TAG to env file
+          command: |
+            echo "export AST_DATA_TAG='${AST_DATA_TAG}'" > /tmp/ast_data_env
+      - persist_to_workspace:
+          root: "/tmp"
+          paths:
+            - ast_data_env
+
+workflows:
+  release-publish-workflow:
+    jobs:
+      - publish-github-release-and-images:
+          filters:
+            branches:
+              only:
+                - "branch_name_template_to_replace"
+          context:
+            - AWS
+            - JFROG

.github/scripts/metrics/get_metrics.py

@@ -9,6 +9,8 @@
 queries_path = {
     'ansible': os.path.join(queries_basepath, 'ansible', '**', '*'),
     'azureresourcemanager': os.path.join(queries_basepath, 'azureResourceManager', '*'),
+    'buildah': os.path.join(queries_basepath, 'buildah', '*'),
+    'cicd': os.path.join(queries_basepath, 'cicd', '**', '*'),
     'cloudformation': os.path.join(queries_basepath, 'cloudFormation', '**', '*'),
     'openapi': os.path.join(queries_basepath, 'openAPI', '**', '*'),
     'crossplane': os.path.join(queries_basepath, 'crossplane',"**" ,'*'),
@@ -22,10 +24,12 @@
     'dockerCompose': os.path.join(queries_basepath, 'dockerCompose', '*'),
     'pulumi': os.path.join(queries_basepath, 'pulumi', "**", '*'),
     'serverlessFW': os.path.join(queries_basepath, 'serverlessFW', '*'),
-
 }
+
 samples_ext = {
     'azureresourcemanager': ['json'],
+    'buildah': ['sh'],
+    'cicd': ['yaml'],
     'cloudformation': ['yaml', 'json'],
     'crossplane': ['yaml'],
     'openapi': ['yaml', 'json'],

.github/scripts/queries-validator/metadata-schema.json

@@ -76,7 +76,8 @@
                 "aws",
                 "azure",
                 "common",
-                "gcp"
+                "gcp",
+                "nifcloud"
             ]
         },
         "platform": {
@@ -139,6 +140,15 @@
                     }
                 }
             }
+        },
+        "experimental": {
+            "type": "string",
+            "enum": [
+                "true"
+            ]
+        },
+        "cwe": {
+            "type": "string"
         }
     }
 }

.github/workflows/go-ci-metrics.yaml

@@ -26,7 +26,7 @@ jobs:
           curl -L \
             https://img.shields.io/badge/Queries-${{ steps.metrics.outputs.total_queries }}-blue.svg > queries.svg
           cat queries.svg
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: ${{ runner.os }}-queries-badge-latest
           path: queries.svg
@@ -44,7 +44,7 @@ jobs:
           git config --global user.name "KICSBot"
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
       - name: Download Queries Badge SVG
-        uses: actions/download-artifact@master
+        uses: actions/download-artifact@v4
         with:
           name: ${{ runner.os }}-queries-badge-latest
           path: latest-metrics

.github/workflows/go-ci.yml

@@ -14,6 +14,7 @@ jobs:
         uses: actions/setup-go@v4
         with:
           go-version: 1.20.x
+          cache: false
       - name: golangci-lint
         uses: golangci/[email protected]
         with:

.github/workflows/release-kics-queries-repo-branch.yaml

@@ -0,0 +1,46 @@
+name: release-kics-queries-repo-branch
+on:
+  release:
+    types:
+      - published
+jobs:
+  create-branch:
+    runs-on: ubuntu-latest
+    env:
+      REPO_NAME: "kics-queries-repo"
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+
+    - name: Set up Git credentials
+      run: |
+          git config --global user.name "${{ github.actor }}"
+          git config --global url."https://${{ secrets.CHECKMARXDEV_GIT_TOKEN }}@github.com".insteadOf "https://github.com"
+
+    - name: Clone kics-queries-repo from CheckmarxDev
+      run: |
+          cd ..
+          git clone https://github.com/CheckmarxDev/$REPO_NAME.git
+
+    - name: Create new branch for release ${{ github.event.release.name }}
+      run: |
+          cd ../$REPO_NAME
+          git checkout -b ${{ github.event.release.name }}
+
+    - name: Copy queries to new branch
+      run: |
+          mkdir -p ../$REPO_NAME/kics-queries
+          rsync -av --exclude='*/test/*' --exclude='common/*' ./assets/queries/ ../$REPO_NAME/kics-queries/
+
+    - name: Copy circle ci configuration to new branch
+      run: |
+          mkdir -p ../$REPO_NAME/.circleci
+          sed 's/branch_name_template_to_replace/${{ github.event.release.name }}/g' .github/scripts/kics-queries-repo-branch-creation/config-template/config.yml > .github/scripts/kics-queries-repo-branch-creation/config.yml
+          cp .github/scripts/kics-queries-repo-branch-creation/config.yml ../$REPO_NAME/.circleci/
+
+    - name: Push branch
+      run: |
+          cd ../$REPO_NAME
+          git add .
+          git commit -m "Add queries from release ${{ github.event.release.name }} to $REPO_NAME"
+          git push origin ${{ github.event.release.name }}

.github/workflows/update_software_versions.yml

@@ -18,7 +18,7 @@ jobs:
           pip3 install -r .github/scripts/update_versions/requirements.txt
           python3 .github/scripts/update_versions/update.py
       - name: Verify Changed files
-        uses: tj-actions/verify-changed-files@v13.1
+        uses: tj-actions/verify-changed-files@v17
         id: verify-changed-files
         with:
           files: |

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21.0-alpine as build_env
+FROM golang:1.21.5-alpine as build_env
 
 # Copy the source from the current directory to the Working Directory inside the container
 WORKDIR /app
@@ -44,19 +44,19 @@ Run apk update --no-cache \
     git~=2.40
 
 # Install Terraform and Terraform plugins
-RUN wget https://releases.hashicorp.com/terraform/1.3.9/terraform_1.3.9_linux_amd64.zip \
-    && unzip terraform_1.3.9_linux_amd64.zip && rm terraform_1.3.9_linux_amd64.zip \
+RUN wget https://releases.hashicorp.com/terraform/1.5.6/terraform_1.5.6_linux_amd64.zip \
+    && unzip terraform_1.5.6_linux_amd64.zip && rm terraform_1.5.6_linux_amd64.zip \
     && mv terraform /usr/bin/terraform \
-    && wget https://releases.hashicorp.com/terraform-provider-azurerm/3.18.0/terraform-provider-azurerm_3.18.0_linux_amd64.zip \
+    && wget https://releases.hashicorp.com/terraform-provider-azurerm/3.71.0/terraform-provider-azurerm_3.71.0_linux_amd64.zip \
     && wget https://releases.hashicorp.com/terraform-provider-aws/3.72.0/terraform-provider-aws_3.72.0_linux_amd64.zip \
     && wget https://releases.hashicorp.com/terraform-provider-google/4.32.0/terraform-provider-google_4.32.0_linux_amd64.zip \
-    && unzip terraform-provider-azurerm_3.18.0_linux_amd64.zip && rm terraform-provider-azurerm_3.18.0_linux_amd64.zip\
+    && unzip terraform-provider-azurerm_3.71.0_linux_amd64.zip && rm terraform-provider-azurerm_3.71.0_linux_amd64.zip\
     && unzip terraform-provider-google_4.32.0_linux_amd64.zip && rm terraform-provider-google_4.32.0_linux_amd64.zip \
     && unzip terraform-provider-aws_3.72.0_linux_amd64.zip && rm terraform-provider-aws_3.72.0_linux_amd64.zip \
-    && mkdir ~/.terraform.d && mkdir ~/.terraform.d/plugins && mkdir ~/.terraform.d/plugins/linux_amd64 && mv terraform-provider-aws_v3.72.0_x5 terraform-provider-google_v4.32.0_x5 terraform-provider-azurerm_v3.18.0_x5 ~/.terraform.d/plugins/linux_amd64
+    && mkdir ~/.terraform.d && mkdir ~/.terraform.d/plugins && mkdir ~/.terraform.d/plugins/linux_amd64 && mv terraform-provider-aws_v3.72.0_x5 terraform-provider-google_v4.32.0_x5 terraform-provider-azurerm_v3.71.0_x5 ~/.terraform.d/plugins/linux_amd64
 
 # Install Terraformer
-RUN wget https://github.com/GoogleCloudPlatform/terraformer/releases/download/0.8.22/terraformer-all-linux-amd64 \
+RUN wget https://github.com/GoogleCloudPlatform/terraformer/releases/download/0.8.24/terraformer-all-linux-amd64 \
     && chmod +x terraformer-all-linux-amd64 \
     && mv terraformer-all-linux-amd64 /usr/bin/terraformer
 

Makefile

@@ -148,13 +148,13 @@ run-local: build
 .PHONY: generate-queries-docs
 generate-queries-docs: ## generate queries catalog md files
 	$(call print-target)
-	@pip3 install -r .github/generators/requirements.txt
-	@python3 -u .github/generators/docs_generator.py \
+	@pip3 install -r .github/scripts/docs-generator/requirements.txt
+	@python3 -u .github/scripts/docs-generator/docs-generator.py \
 		-p ./assets/queries/ \
 		-o ./docs/queries/ \
 		-f md \
-		-t .github/generators/templates
-	@python3 -u .github/scripts/docs-generator/query-page-generator/query-page-generator.py \
+		-t .github/scripts/docs-generator/templates
+	@python3 -u -B .github/scripts/docs-generator/query-page-generator/query-page-generator.py \
     	-p ./assets/queries/ \
         -o ./docs/queries/ \
         -f md \

README.md

@@ -2,9 +2,9 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 [![Queries](https://raw.githubusercontent.com/Checkmarx/kics/gh-pages/queries.svg)](https://docs.kics.io/develop/queries/all-queries/)
 [![Docker Pulls](https://img.shields.io/docker/pulls/checkmarx/kics)](https://hub.docker.com/r/checkmarx/kics)
-[![Documentation](https://img.shields.io/badge/docs-viewdocs-blue.svg?style=flat-square "Viewdocs")](https://docs.kics.io/)
-[![GitHub Discussions](https://img.shields.io/badge/chat-discussions-blue.svg?logo=github&style=flat-square)](https://github.com/Checkmarx/kics/discussions)
-[![Discord Server](https://img.shields.io/discord/1116626376674521169?logo=discord&style=flat-square)](https://discord.gg/nzryxFup6Z)
+![GitHub contributors](https://img.shields.io/github/contributors/checkmarx/kics?color=blue&link=https%3A%2F%2Fgithub.com%2FCheckmarx%2Fkics%2Fgraphs%2Fcontributors)
+[![Documentation](https://img.shields.io/badge/docs-viewdocs-blue.svg "Viewdocs")](https://docs.kics.io/)
+[![GitHub Discussions](https://img.shields.io/badge/chat-discussions-blue.svg?logo=github)](https://github.com/Checkmarx/kics/discussions)
 
 [![checkmarx](https://img.shields.io/endpoint?url=https://pgp36n22ol.execute-api.eu-west-1.amazonaws.com/dev/cxflowcache-results?style=plastic&logoWidth=20&logo=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAA7EAAAOxAGVKw4bAAADbklEQVRYhc2XTWidRRSGn3MJl1AkZFFcFCkFIYKCYMEgIhZEMtNS2kHBvxYbl1kUIqELQXHhQigtCK266EIoSt0YplbsTJGqaFFahC6yiiJFUIJ2IUGClJLj4vvu/X7uTC7cJOoLH5eZM3Ped37OOXPhP4akOl20XeAQsB+YAsZH9H8HuAVcAxa9CStDBbhgDyKcAfaMSJoVo8pZEd7wJqwNCHDRdlSZF+H0FhO3cR3FeBv+BOjUDM8InEZhm79pFT5w0Xb6Aly0Eyjvb+OqGxBVBzwJMAaA8jLCTrQ3olRbHNBv5TcKxoCH6e10z6cKKMeAr8ZKwsN94r5MABaAd7wJ6yMKwEU7A8SG/+J3Gqo78GBi7tXNkpf4giIUG1CYBOiUl2FHYuLNLSAH1SnQXQnDbYBOlkTZNHmRU+QbkG7bJsi3UF3CQbRS1OFoxwSeRplEuOpN+D1LHO048DbKfNJ3gXPQzANZuGh3CHyNchm4gPKji/axzNgp4BrKfN6jnvU23KwJSMhsds2iPF5rT6jqJy7ae2vEHRftUVR/QNm7wXoCIid6jTIMhYEc0BRzf/9ISpuI7EK54KI1qoyrckZgdsBXfTHCe8Cr3oQ7PdfVEQjNOG3mhC8z454CzolwQ4TZDeavIjwPHK+TVzswHJ+jfIhwNGGbHTL3e+CIN+HnlDF/B2rwJqwjzAFLw5RW0HXgJLAvRw79HUi8S1qavAl/uWifBb0BMjGEfQXkmDfhSr2zLHr3ACveFvknH4YJTd6EZUVe2ZBauQI8UicvI+Qt4A+EXxH9zkV7XyUgVbczuGjCIsqpxJy7wAmE/Ymn1wzK6yjdYqxMA+9C/wiq2ltbSR7Cayi7FZ4rZulPKnLkognXM7uyL9H3BPR2QGSwFEv+eLwJdxFeFOEBhEcReShLXvjrtkoxSFEIe2G4BkzWRWjxGs6iLGLLG42p+5ImOcCaN2G9J2AJaJRMgQMu2peAj0cty2WpfwE4kDAvQZWILgEzrQEd4CNgwUXzS/OM2ncm294N2bpwqS7gvMKbAjsTA/eCtJy0Y3RYuwlVbotwHspL6E1YFWXuX3iSg4LAnDdhtS+gFL2oxSN0eyEsICxWzRZctAfL0rpnK3kVbolw3JvwWVNPAi7aLsohZNN/Tv8GllEuI3zaLsX/C/wDM7pjD59N2pkAAAAASUVORK5CYII=)](https://sast.checkmarx.net/cxwebclient/portal#/projectState/702/Summary)
 [![Codacy Badge](https://app.codacy.com/project/badge/Grade/ceddb5b1b37d4edfa56440842c6248a4)](https://www.codacy.com/gh/Checkmarx/kics/dashboard?utm_source=github.com&utm_medium=referral&utm_content=Checkmarx/kics&utm_campaign=Badge_Grade)
@@ -55,9 +55,13 @@ Find security vulnerabilities, compliance issues, and infrastructure misconfigur
 <br>
 <img alt="Azure BluePrints" src="docs/img/logo-azure-blueprints.png" width="100">&nbsp;&nbsp;&nbsp;
 <img alt="GitHub Workflows" src="docs/img/logo-github-icon.png" width="100">&nbsp;&nbsp;&nbsp;
+<img alt="OpenTofu" src="docs/img/logo-opentofu.png" width="150">&nbsp;&nbsp;&nbsp;
 
+#### Beta Features
+<img alt="Databricks" src="docs/img/logo-databricks.png" width="200">&nbsp;&nbsp;&nbsp;
+<img alt="NIFCloud" src="docs/img/logo-nifcloud.png" width="110">&nbsp;&nbsp;&nbsp;
 
-Support of other solutions and additional cloud providers are on the [roadmap](docs/roadmap.md).
+In order to run the Databricks and NIFCloud queries, use the `--experimental-queries` flag when running KICS.
 
 ## Getting Started
 
@@ -79,29 +83,32 @@ What makes KICS really powerful and popular is its built-in extensibility. This
 -   Fully customizable and adjustable heuristics rules, called [queries](docs/queries.md). These can be easily edited, extended and added.
 -   Robust but yet simple [architecture](docs/architecture.md), which allows quick addition of support for new Infrastructure as Code solutions.
 
-## Contribution
+## Community
 
-KICS is a true community project. It's built as an open source from day one, and anyone can find his own way to contribute to the project.
-[Check out how](docs/CONTRIBUTING.md), within just minutes, you can start making a difference, by sharing your expertise with a community of thousands of security experts and software developers.
+You're welcome to join our [community](docs/community.md), talk with us on <a href="https://github.com/Checkmarx/kics/discussions" target="_blank">GitHub discussions</a> or contact KICS core team at [[email protected]](mailto:[email protected]).
 
-You're welcome to join our monthly [community meetings](docs/community.md), talk with us on <a href="https://github.com/Checkmarx/kics/discussions" target="_blank">GitHub discussions</a> or contact KICS core team at [[email protected]](mailto:[email protected]).
+### KICS Contributors
 
-## Meet us at conferences
+See our individual contributors in the [community](docs/community.md) page. You're welcome to join them by [contributing](docs/CONTRIBUTING.md) to KICS.
 
--   [Blackhat ASIA 2023](https://www.blackhat.com/asia-23/arsenal/schedule/index.html#kics---your-iac-secure-now-31009) (video TBD)
--   [AWS re:Invent 2021: AWS On Air](https://youtu.be/9ZKldJeBHl4) ([video](https://youtu.be/9ZKldJeBHl4))
--   [OWASP Bristol & Suffolk Chapter - Meetup](https://www.meetup.com/OWASP-Bristol/events/281869377/) ([video](https://youtu.be/KKZJEJF6I0M))
--   [OWASP Canberra Chapter - Meetup](https://www.meetup.com/OWASP-Canberra-Chapter/events/281946376/)
--   [InfoSec City - Singapore 2021](https://www.infosec-city.com/sin21-bizcomm)
--   [DevSecOps Singapore 2021](https://devopscon.io/cloud-platforms-serverless/infrastructure-is-the-new-code-is-your-devsecops-ready/)
--   [Blackhat Europe 2021](https://www.blackhat.com/eu-21/arsenal/schedule/#kics-keeping-infrastructure-as-code-secure-25111)
--   [HashiTalks IL 2021](https://events.hashicorp.com/hashitalksisrael) ([video](https://www.youtube.com/watch?v=DFRiSVH4lu0))
--   [Yalla DevOps 2021](https://yalla-devops.com/) ([video](https://youtu.be/Hs_YbAH9giI))
--   [Geektime Code 2021](https://code.geektime.co.il/)
--   [DevSecCon24 2021](https://www.devseccon.com/devseccon24-2021/) ([video](https://www.youtube.com/watch?v=eaD-tGMOKe8))
--   [GISEC Global 2021](https://www.gisec.ae/gisec-2021-conference/insecure-infrastructure-as-code-leaves-the-door-open-for-hackers-1wez)
--   [Blackhat ASIA 2021](https://www.blackhat.com/asia-21/arsenal/schedule/#kics-22475) ([video](https://www.youtube.com/watch?v=56AM1wiIOss))
+We also like to thank the following organizations for their ongoing contribution:
+-   [Checkmarx](https://checkmarx.com/)
+-   [Bedrock Streaming](https://bedrockstreaming.com/) (since v1.4.8)
+-   [Dynatrace](https://www.dynatrace.com/) (since v1.5.1)
+-   [Orca Security](https://orca.security/) (since v1.5.10)
 
+### KICS Users
+KICS is used by various companies and organizations, some are listed below. If you would like to be included here please open a PR.
+
+-   [Checkmarx](https://checkmarx.com/) ([IaC Security](https://checkmarx.com/product/iac-security/))
+-   [GitLab](https://gitlab.com/) ([Infrastructure as Code scanning](https://docs.gitlab.com/ee/user/application_security/iac_scanning/))
+-   [Bedrock Streaming](https://bedrockstreaming.com/)
+-   [Cisco](https://www.panoptica.app/) ([CI/CD Securitry](https://docs.panoptica.app/docs/ci-cd-security))
+-   [Orca Security](https://orca.security/)
+-   [JIT](https://www.jit.io/) ([SAST for IaC](https://www.jit.io/security-tools/kics))
+-   [Firefly](https://www.firefly.ai/)
+-   [Redpanda](https://redpanda.com/)
+-   [Keptn](https://keptn.sh)
 
 **Keeping Infrastructure as Code Secure!**
 

assets/libraries/ansible.rego

@@ -147,3 +147,13 @@ isEntireNetwork(cidr) {
 	cidrs = {"0.0.0.0/0", "::/0"}
 	cidr == cidrs[j]
 }
+
+installer_modules := [
+	"community.general.apk", "ansible.builtin.apt", "ansible.builtin.apt", "community.general.bundler", "ansible.builtin.dnf", "community.general.easy_install", 
+	"community.general.gem", "community.general.homebrew", "community.general.jenkins_plugin", "community.general.npm", "community.general.openbsd_pkg", 
+	"ansible.builtin.package", "ansible.builtin.package", "community.general.pear", "community.general.pacman", "ansible.builtin.pip", "community.general.pkg5", 
+	"community.general.pkgutil", "community.general.pkgutil", "community.general.portage", "community.general.slackpkg", "community.general.sorcery", 
+	"community.general.swdepot", "win_chocolatey", "community.general.yarn", "ansible.builtin.yum", "community.general.zypper", "apk", "apt", "bower", "bundler", 
+	"dnf", "easy_install", "gem", "homebrew", "jenkins_plugin", "npm", "openbsd_package", "openbsd_pkg", "package", "pacman", "pear", "pip", "pkg5", "pkgutil", 
+	"portage", "slackpkg", "sorcery", "swdepot", "win_chocolatey", "yarn", "yum", "zypper",
+]

assets/libraries/openapi.rego

@@ -226,9 +226,21 @@ get_schema_info(doc, version) = schemaInfo {
 api_key_exposed(doc, version, s) {
 	version == "3.0"
 	doc.components.securitySchemes[s].type == "apiKey"
+	server := doc.servers[_]
+	startswith(server.url, "http://")
+} else {
+	version == "3.0"
+	doc.components.securitySchemes[s].type == "apiKey"
+	not valid_key(doc, "servers")
+} else {
+	version == "2.0"
+	doc.securityDefinitions[s].type == "apiKey"
+	scheme := doc.schemes[_]
+    scheme == "http"
 } else {
 	version == "2.0"
 	doc.securityDefinitions[s].type == "apiKey"
+	not valid_key(doc, "schemes")
 }
 
 check_scheme(doc, schemeKey, scope, version) {