Merge pull request #6626 from Checkmarx/kics-968-allow-unsafe-lookups

feat(query): ansible config allow unsafe lookups

assets/queries/ansible/config/allow_unsafe_lookups_enabled/metadata.json

@@ -0,0 +1,12 @@
+{
+    "id": "86b97bb4-85c9-462d-8635-cbc057c5c8c5",
+    "queryName": "Allow Unsafe Lookups Enabled",
+    "severity": "HIGH",
+    "category": "Insecure Configurations",
+    "descriptionText": "When enabled, this option allows lookup plugins to return data that is not marked 'unsafe'.",
+    "descriptionUrl": "https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-allow-unsafe-lookups",
+    "platform": "Ansible",
+    "descriptionID": "0d491461",
+    "cloudProvider": "common"
+  }
+

assets/queries/ansible/config/allow_unsafe_lookups_enabled/query.rego

@@ -0,0 +1,19 @@
+package Cx
+
+import data.generic.ansible as ansLib
+
+CxPolicy[result] {
+	defaultsGroup := input.document[i].groups.defaults
+
+    defaultsGroup.allow_unsafe_lookups == true
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceName": "defaults",
+		"resourceType": "n/a",
+		"searchKey": "defaults.allow_unsafe_lookups",
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": "allow_unsafe_lookups should be set to 'False'",
+		"keyActualValue": "allow_unsafe_lookups is set to 'True'",
+	}
+}

assets/queries/ansible/config/allow_unsafe_lookups_enabled/test/negative1.cfg

@@ -0,0 +1,19 @@
+[defaults]
+action_warnings=True
+cowsay_enabled_stencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www
+cow_selection=default
+force_color=False
+nocolor=False
+nocows=False
+any_errors_fatal=False
+become_plugins=~/.ansible/plugins/become:/usr/share/ansible/plugins/become
+fact_caching=memory
+fact_caching_prefix=ansible_facts
+fact_caching_timeout=86400
+collections_on_ansible_version_mismatch=warning
+collections_path=~/.ansible/collections:/usr/share/ansible/collections
+collections_scan_sys_path=True
+command_warnings=False
+action_plugins=~/.ansible/plugins/action:/usr/share/ansible/plugins/action
+
+allow_unsafe_lookups=False

assets/queries/ansible/config/allow_unsafe_lookups_enabled/test/negative2.cfg

@@ -0,0 +1,17 @@
+[defaults]
+action_warnings=True
+cowsay_enabled_stencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www
+cow_selection=default
+force_color=False
+nocolor=False
+nocows=False
+any_errors_fatal=False
+become_plugins=~/.ansible/plugins/become:/usr/share/ansible/plugins/become
+fact_caching=memory
+fact_caching_prefix=ansible_facts
+fact_caching_timeout=86400
+collections_on_ansible_version_mismatch=warning
+collections_path=~/.ansible/collections:/usr/share/ansible/collections
+collections_scan_sys_path=True
+command_warnings=False
+action_plugins=~/.ansible/plugins/action:/usr/share/ansible/plugins/action

assets/queries/ansible/config/allow_unsafe_lookups_enabled/test/positive1.cfg

@@ -0,0 +1,19 @@
+[defaults]
+action_warnings=True
+cowsay_enabled_stencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www
+cow_selection=default
+force_color=False
+nocolor=False
+nocows=False
+any_errors_fatal=False
+become_plugins=~/.ansible/plugins/become:/usr/share/ansible/plugins/become
+fact_caching=memory
+fact_caching_prefix=ansible_facts
+fact_caching_timeout=86400
+collections_on_ansible_version_mismatch=warning
+collections_path=~/.ansible/collections:/usr/share/ansible/collections
+collections_scan_sys_path=True
+command_warnings=False
+action_plugins=~/.ansible/plugins/action:/usr/share/ansible/plugins/action
+
+allow_unsafe_lookups=True

assets/queries/ansible/config/allow_unsafe_lookups_enabled/test/positive_expected_result.json

@@ -0,0 +1,7 @@
+[
+	{
+		"queryName": "Allow Unsafe Lookups Enabled",
+		"severity": "HIGH",
+		"line": 19
+	}
+]

docs/creating-queries.md

@@ -382,6 +382,8 @@ To improve the KICS line detection mechanism, `searchLine` was introduced.
 
 SearchLine uses json path to get the correct line information from the payload (which can be seen with the flag `payload-lines`).
 
+For Ansible Hosts and Config files, there is no need to fill this parameter since the attributes can vary in different files. If you still want to use you will expect an inconsistent behaviour.
+
 Original Content:
 ```
 father:

test/main_test.go

@@ -14,6 +14,7 @@ import (
 	"github.com/Checkmarx/kics/pkg/kics"
 	"github.com/Checkmarx/kics/pkg/model"
 	"github.com/Checkmarx/kics/pkg/parser"
+	ansibleConfigParser "github.com/Checkmarx/kics/pkg/parser/ansible/ini/config"
 	ansibleHostsParser "github.com/Checkmarx/kics/pkg/parser/ansible/ini/hosts"
 	buildahParser "github.com/Checkmarx/kics/pkg/parser/buildah"
 	dockerParser "github.com/Checkmarx/kics/pkg/parser/docker"
@@ -52,6 +53,7 @@ var (
 		"../assets/queries/ansible/aws":                     {FileKind: []model.FileKind{model.KindYAML}, Platform: "ansible"},
 		"../assets/queries/ansible/gcp":                     {FileKind: []model.FileKind{model.KindYAML}, Platform: "ansible"},
 		"../assets/queries/ansible/azure":                   {FileKind: []model.FileKind{model.KindYAML}, Platform: "ansible"},
+		"../assets/queries/ansible/config":                  {FileKind: []model.FileKind{model.KindCFG}, Platform: "ansible"},
 		"../assets/queries/ansible/hosts":                   {FileKind: []model.FileKind{model.KindINI, model.KindYAML}, Platform: "ansible"},
 		"../assets/queries/dockerfile":                      {FileKind: []model.FileKind{model.KindDOCKER}, Platform: "dockerfile"},
 		"../assets/queries/dockerCompose":                   {FileKind: []model.FileKind{model.KindYAML}, Platform: "dockerCompose"},
@@ -192,6 +194,7 @@ func getCombinedParser() []*parser.Parser {
 		Add(&dockerParser.Parser{}).
 		Add(&protoParser.Parser{}).
 		Add(&buildahParser.Parser{}).
+		Add(&ansibleConfigParser.Parser{}).
 		Add(&ansibleHostsParser.Parser{}).
 		Build([]string{""}, []string{""})
 	return bd