cfn-nag 0.0.19 → 0.0.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a6f51c774a431b7ee4eab98fa149a70ff1a283f1
-  data.tar.gz: 23e9f0da9f74d5ece4bc88ea95a17ffc243cfeeb
+  metadata.gz: dcadc8f647c513a6b89a00d1f65dce2a58bfd67c
+  data.tar.gz: c2b937a48509a75a7794dd57bdab96515786b18b
 SHA512:
-  metadata.gz: 97a5694d46ea7e28064cd460b5330bcdab08380e6499098d5002c06006caf4005adc43c085601eb3e5f188b09e4b468bf9b9ed61ab0344dc0de0d81f49836ba9
-  data.tar.gz: 394aa5251dd4975985c082a6014741e8c854a6d31c1d54b4fe2d6cd9177a97828efd906561b2243582aa41b85252c3b782c069fc61e47d32ef85ab8b3c46082e
+  metadata.gz: 69d402fae0584179a7c6ad6fee475fc0409f3ca817d030eae7c8be552a197290cb6e998db555e7d8fc446a443ec38cb57a843bc8ebe8f75de0633e80d246f6af
+  data.tar.gz: 42a9d0dc9efcfc155d2fac8b5b16f1ccbe41f732372495548f344038a9839a06263a2c9e5576946770cc5611d1e2533d5be8c314478f3b1e46cf7800f8746f5e

data/bin/cfn_nag

@@ -4,7 +4,7 @@ require 'cfn_nag'
 require 'logging'
 
 opts = Trollop::options do
-  opt :input_json_path, 'Cloudformation template to nag on or directory of templates - all *.json and *.template recursively', type: :io, required: true
+  opt :input_json_path, 'CloudFormation template to nag on or directory of templates - all *.json and *.template recursively', type: :io, required: true
   opt :output_format, 'Format of results: [txt, json]', type: :string, default: 'txt'
   opt :debug, 'Enable debug output', type: :boolean, required: false, default: false
 end

data/lib/cfn_nag.rb

@@ -92,19 +92,23 @@ class CfnNag
   end
 
   def audit_file(input_json_path:)
+    audit_template(input_json: IO.read(input_json_path))
+  end
+
+  def audit_template(input_json:)
     @stop_processing = false
     @violations = []
 
-    unless legal_json?(input_json_path)
+    unless legal_json?(input_json)
       @violations << Violation.new(type: Violation::FAILING_VIOLATION,
                                    message: 'not even legit JSON',
-                                   violating_code: IO.read(input_json_path))
+                                   violating_code: input_json)
       @stop_processing = true
     end
 
-    generic_json_rules input_json_path unless @stop_processing == true
+    generic_json_rules input_json unless @stop_processing == true
 
-    custom_rules input_json_path unless @stop_processing == true
+    custom_rules input_json unless @stop_processing == true
 
     {
       failure_count: Rule::count_failures(@violations),
@@ -141,9 +145,9 @@ class CfnNag
     registry[output_format]
   end
 
-  def legal_json?(input_json_path)
+  def legal_json?(input_json)
     begin
-      JSON.parse(IO.read(input_json_path))
+      JSON.parse(input_json)
       true
     rescue JSON::ParserError
       return false
@@ -151,22 +155,23 @@ class CfnNag
   end
 
   def command?(command)
-    system("which #{command} > /dev/null 2>&1")
+    not system("#{command} > /dev/null 2>&1").nil?
   end
 
-  def generic_json_rules(input_json_path)
+  def generic_json_rules(input_json)
     unless command? 'jq'
       fail 'jq executable must be available in PATH'
     end
 
+    puts "GENERIC JSON RULES FROM: #{__dir__}"
     Dir[File.join(__dir__, 'json_rules', '*.rb')].sort.each do |rule_file|
-      @input_json_path = input_json_path
+      @input_json = input_json
       eval IO.read(rule_file)
     end
   end
 
-  def custom_rules(input_json_path)
-    cfn_model = CfnModel.new.parse(IO.read(input_json_path))
+  def custom_rules(input_json)
+    cfn_model = CfnModel.new.parse(input_json)
     custom_rule_registry.each do |rule_class|
       audit_result = rule_class.new.audit(cfn_model)
       @violations << audit_result unless audit_result.nil?

data/lib/json_rules/basic_rules.rb

@@ -1,5 +1,5 @@
 raw_fatal_assertion jq: '.Resources|length > 0',
-                    message: 'A Cloudformation template must have at least 1 resource'
+                    message: 'A CloudFormation template must have at least 1 resource'
 
 
 %w(
@@ -42,4 +42,4 @@ raw_fatal_violation jq: missing_reference_jq,
 ).each do |xgress|
   fatal_violation jq: "[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == \"#{xgress}\" and .Properties.GroupName != null)]|map(.LogicalResourceId)",
                   message: "#{xgress} must not have GroupName - EC2 classic is a no-go!"
-end
+end

data/lib/rule.rb

@@ -2,7 +2,7 @@ require 'logging'
 require_relative 'violation'
 
 module Rule
-  attr_accessor :input_json_path
+  attr_accessor :input_json
 
   # jq preamble to spit out Resources but as an array of key-value pairs
   # can be used in jq rule definition but... this is probably reducing replication at the cost of opaqueness
@@ -10,7 +10,7 @@ module Rule
     '.Resources|with_entries(.value.LogicalResourceId = .key)[]'
   end
 
-  # jq to filter Cloudformation resources by Type
+  # jq to filter CloudFormation resources by Type
   # can be used in jq rule definition but... this is probably reducing replication at the cost of opaqueness
   def resources_by_type(resource)
     "#{resources}| select(.Type == \"#{resource}\")"
@@ -23,7 +23,7 @@ module Rule
 
     Logging.logger['log'].debug jq
 
-    stdout = jq_command(@input_json_path, jq)
+    stdout = jq_command(@input_json, jq)
     result = $?.exitstatus
     scrape_jq_output_for_error(jq, stdout)
 
@@ -145,7 +145,7 @@ module Rule
 
     Logging.logger['log'].debug jq_expression
 
-    stdout = jq_command(@input_json_path, jq_expression)
+    stdout = jq_command(@input_json, jq_expression)
     result = $?.exitstatus
     scrape_jq_output_for_error(jq_expression, stdout)
     if (fail_if_found and result == 0) or
@@ -175,13 +175,16 @@ module Rule
     end
   end
 
-  # the -e will return an exit code
-  def jq_command(input_json_path, jq_expression)
-    command = "cat #{input_json_path} | jq '#{jq_expression}' -e 2>&1"
-
-    Logging.logger['log'].debug command
+  def quote(string)
+    "'#{string}'"
+  end
 
-    `#{command}`
+  # the -e will return an exit code
+  def jq_command(input_json, jq_expression)
+    IO.popen(['jq', jq_expression, '-e'], 'r+', {:err=>[:child, :out]}) do |pipe|
+      pipe << input_json
+      pipe.close_write
+      pipe.readlines.join
+    end
   end
 end
-

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.0.19
+  version: 0.0.20
 platform: ruby
 authors:
 - someguy
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-03-24 00:00:00.000000000 Z
+date: 2017-01-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logging
@@ -96,7 +96,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.2
+rubygems_version: 2.6.3
 signing_key: 
 specification_version: 4
 summary: cfn-nag