inspec-core 5.22.29 → 6.6.0

data/lib/inspec/runner.rb

@@ -11,6 +11,7 @@ require "inspec/dependencies/cache"
 require "inspec/dist"
 require "inspec/reporters"
 require "inspec/runner_rspec"
+require "chef-licensing"
 # spec requirements
 
 module Inspec
@@ -60,11 +61,13 @@ module Inspec
       end
 
       if @conf[:waiver_file]
-        @conf[:waiver_file].each do |file|
-          unless File.file?(file)
-            raise Inspec::Exceptions::WaiversFileDoesNotExist, "Waiver file #{file} does not exist."
+        Inspec.with_feature("inspec-waivers") {
+          @conf[:waiver_file].each do |file|
+            unless File.file?(file)
+              raise Inspec::Exceptions::WaiversFileDoesNotExist, "Waiver file #{file} does not exist."
+            end
           end
-        end
+        }
       end
 
       # About reading inputs:
@@ -159,16 +162,42 @@ module Inspec
     end
 
     def run(with = nil)
+      ChefLicensing.check_software_entitlement! if Inspec::Dist::EXEC_NAME == "inspec"
+
+      # Validate if profiles are signed and verified
+      # Additional check is required to provide error message in case of inspec exec command (exec command can use multiple profiles as well)
+      # Only runs this block when preview flag CHEF_PREVIEW_MANDATORY_PROFILE_SIGNING is set
+      Inspec.with_feature("inspec-mandatory-profile-signing") {
+        unless @conf.allow_unsigned_profiles?
+          verify_target_profiles_if_signed(@target_profiles)
+        end
+      }
+
       Inspec::Log.debug "Starting run with targets: #{@target_profiles.map(&:to_s)}"
       load
       run_tests(with)
+    rescue ChefLicensing::SoftwareNotEntitled
+      Inspec::Log.error "License is not entitled to use InSpec."
+      Inspec::UI.new.exit(:license_not_entitled)
+    rescue ChefLicensing::Error => e
+      Inspec::Log.error e.message
+      Inspec::UI.new.exit(:usage_error)
+    end
+
+    def verify_target_profiles_if_signed(target_profiles)
+      unsigned_profiles = []
+      target_profiles.each do |profile|
+        unsigned_profiles << profile.name unless profile.verify_if_signed
+      end
+      raise Inspec::ProfileSignatureRequired, "Signature required for profile/s: #{unsigned_profiles.join(", ")}. Please provide a signed profile. Or set CHEF_ALLOW_UNSIGNED_PROFILES in the environment. Or use `--allow-unsigned-profiles` flag with InSpec CLI. " unless unsigned_profiles.empty?
     end
 
     def render_output(run_data)
       return if @conf["reporter"].nil?
 
       @conf["reporter"].each do |reporter|
-        result = Inspec::Reporters.render(reporter, run_data, @conf["enhanced_outcomes"])
+        enhanced_outcome_flag = @conf["enhanced_outcomes"]
+        result = Inspec::Reporters.render(reporter, run_data, enhanced_outcome_flag)
         raise Inspec::ReporterError, "Error generating reporter '#{reporter[0]}'" if result == false
       end
     end

data/lib/inspec/runner_rspec.rb

@@ -177,16 +177,18 @@ module Inspec
         next unless streaming_reporters.include? streaming_reporter_name
 
         # Activate the plugin so the formatter ID gets registered with RSpec, presumably
-        activator = reg.find_activator(plugin_type: :streaming_reporter, activator_name: streaming_reporter_name.to_sym)
-        activator.activate!
 
-        # We cannot pass in a nil output path. Rspec only accepts a valid string or a IO object.
-        if file_target&.[]("file").nil?
-          RSpec.configuration.add_formatter(activator.implementation_class)
-        else
-          RSpec.configuration.add_formatter(activator.implementation_class, file_target["file"])
-        end
-        @conf["reporter"].delete(streaming_reporter_name)
+        Inspec.with_feature("inspec-reporter-#{streaming_reporter_name}") {
+          activator = reg.find_activator(plugin_type: :streaming_reporter, activator_name: streaming_reporter_name.to_sym)
+          activator.activate!
+          # We cannot pass in a nil output path. Rspec only accepts a valid string or a IO object.
+          if file_target&.[]("file").nil?
+            RSpec.configuration.add_formatter(activator.implementation_class)
+          else
+            RSpec.configuration.add_formatter(activator.implementation_class, file_target["file"])
+          end
+          @conf["reporter"].delete(streaming_reporter_name)
+        }
       end
     end
 
@@ -196,6 +198,7 @@ module Inspec
     def configure_output
       RSpec.configuration.output_stream = $stdout
       @formatter = RSpec.configuration.add_formatter(Inspec::Formatters::Base)
+
       @formatter.enhanced_outcomes = @conf.final_options["enhanced_outcomes"]
       RSpec.configuration.add_formatter(Inspec::Formatters::ShowProgress, $stderr) if @conf[:show_progress]
       set_optional_formatters

data/lib/inspec/secrets/yaml.rb

@@ -24,12 +24,18 @@ module Secrets
         @inputs = ::YAML.load_file(target)
       end
 
-      if @inputs == false || !@inputs.is_a?(Hash)
-        Inspec::Log.warn("#{self.class} unable to parse #{target}: invalid YAML or contents is not a Hash")
+      # In case of empty yaml file raise the warning else raise the parsing error.
+      if !@inputs || @inputs.empty?
+        Inspec::Log.warn("Unable to parse #{target}: YAML file is empty.")
         @inputs = nil
+      elsif !@inputs.is_a?(Hash)
+        # Exits with usage error.
+        Inspec::Log.error("Unable to parse #{target}: invalid YAML or contents is not a Hash")
+        Inspec::UI.new.exit(:usage_error)
       end
     rescue => e
-      raise "Error reading InSpec inputs: #{e}"
+      # Any other error related to Yaml parsing will be raised here.
+      raise "Error reading YAML file #{target}: #{e}"
     end
   end
 end

data/lib/inspec/shell.rb

@@ -1,3 +1,6 @@
+require "chef-licensing"
+require "inspec/dist"
+
 autoload :Pry, "pry"
 
 module Inspec
@@ -10,6 +13,7 @@ module Inspec
     end
 
     def start
+      ChefLicensing.check_software_entitlement! if Inspec::Dist::EXEC_NAME == "inspec"
       # This will hold a single evaluation binding context as opened within
       # the instance_eval context of the anonymous class that the profile
       # context creates to evaluate each individual test file. We want to
@@ -18,6 +22,12 @@ module Inspec
       @ctx_binding = @runner.eval_with_virtual_profile("binding")
       configure_pry
       @ctx_binding.pry
+    rescue ChefLicensing::SoftwareNotEntitled
+      Inspec::Log.error "License is not entitled to use InSpec."
+      Inspec::UI.new.exit(:license_not_entitled)
+    rescue ChefLicensing::Error => e
+      Inspec::Log.error e.message
+      Inspec::UI.new.exit(:usage_error)
     end
 
     def configure_pry # rubocop:disable Metrics/AbcSize

data/lib/inspec/ui.rb

@@ -32,9 +32,13 @@ module Inspec
     EXIT_FATAL_DEPRECATION = 3
     EXIT_GEM_DEPENDENCY_LOAD_ERROR = 4
     EXIT_BAD_SIGNATURE = 5
+    EXIT_SIGNATURE_REQUIRED = 6
     EXIT_LICENSE_NOT_ACCEPTED = 172
+    EXIT_LICENSE_NOT_ENTITLED = 173
+    EXIT_LICENSE_NOT_SET = 174
     EXIT_FAILED_TESTS = 100
     EXIT_SKIPPED_TESTS = 101
+    EXIT_TERMINATED_BY_CTL_C = 130
 
     attr_reader :io
 

data/lib/inspec/utils/licensing_config.rb

@@ -0,0 +1,9 @@
+require_relative "../log"
+require "chef-licensing"
+ChefLicensing.configure do |config|
+  config.chef_product_name = "InSpec"
+  config.chef_entitlement_id = "3ff52c37-e41f-4f6c-ad4d-365192205968"
+  config.chef_executable_name = "inspec"
+  config.license_server_url = "https://services.chef.io/licensing"
+  config.logger = Inspec::Log
+end

data/lib/inspec/utils/profile_ast_helpers.rb

@@ -0,0 +1,372 @@
+require "ast"
+require "rubocop-ast"
+module Inspec
+  class Profile
+    class AstHelper
+      class CollectorBase
+        include Parser::AST::Processor::Mixin
+        include RuboCop::AST::Traversal
+
+        attr_reader :memo
+        def initialize(memo)
+          @memo = memo
+        end
+      end
+
+      class InputCollectorBase < CollectorBase
+        VALID_INPUT_OPTIONS = %i{name value type required priority pattern profile sensitive}.freeze
+
+        REQUIRED_VALUES_MAP = {
+          true: true,
+          false: false,
+        }.freeze
+
+        def initialize(memo)
+          @memo = memo
+        end
+
+        def collect_input(input_children)
+          input_name = input_children.children[2].value
+
+          # Check if memo[:inputs] already has a value for the input_name, if yes, then skip adding it to the array
+          unless memo[:inputs].any? { |input| input[:name] == input_name }
+            # The value will be updated if available in the input_children
+            opts = {
+              value: "Input '#{input_name}' does not have a value. Skipping test.",
+            }
+
+            if input_children.children[3]&.type == :hash
+              input_children.children[3].children.each do |child_node|
+                if VALID_INPUT_OPTIONS.include?(child_node.key.value)
+                  if child_node.value.class == RuboCop::AST::Node && REQUIRED_VALUES_MAP.key?(child_node.value.type)
+                    opts.merge!(child_node.key.value => REQUIRED_VALUES_MAP[child_node.value.type])
+                  elsif child_node.value.class == RuboCop::AST::HashNode
+                    # Here value will be a hash
+                    values = {}
+                    child_node.value.children.each do |grand_child_node|
+                      values.merge!(grand_child_node.key.value => grand_child_node.value.value)
+                    end
+                    opts.merge!(child_node.key.value => values)
+                  else
+                    opts.merge!(child_node.key.value => child_node.value.value)
+                  end
+                end
+              end
+            end
+
+            # TODO: Add rules for handling the input options or use existing rules if available
+            # 1. Handle pattern matching for the given input value
+            # 2. Handle data-type matching for the given input value
+            # 3. Handle required flag for the given input value
+            # 4. Handle sensitive flag for the given input value
+            memo[:inputs] ||= []
+            input_hash = {
+              name: input_name,
+              options: opts,
+            }
+            memo[:inputs] << input_hash
+          end
+        end
+
+        def check_and_collect_input(node)
+          if input_pattern_match?(node)
+            collect_input(node)
+          else
+            node.children.each do |child_node|
+              check_and_collect_input(child_node) if input_pattern_match?(child_node)
+            end
+          end
+        end
+
+        def input_pattern_match?(node)
+          RuboCop::AST::NodePattern.new("(send nil? :input ...)").match(node)
+        end
+      end
+
+      class ImpactCollector < CollectorBase
+        def on_send(node)
+          if RuboCop::AST::NodePattern.new("(send nil? :impact ...)").match(node)
+            memo[:impact] = node.children[2].value
+          end
+        end
+      end
+
+      class DescCollector < CollectorBase
+        def on_send(node)
+          if RuboCop::AST::NodePattern.new("(send nil? :desc ...)").match(node)
+            memo[:descriptions] ||= {}
+            if node.children[2] && node.children[3]
+              # NOTE: This assumes the description is as below
+              # desc 'label', 'An optional description with a label' # Pair a part of the description with a label
+              memo[:descriptions] = memo[:descriptions].merge(node.children[2].value => node.children[3].value)
+            else
+              memo[:desc] = node.children[2].value
+              memo[:descriptions] = memo[:descriptions].merge(default: node.children[2].value)
+            end
+          end
+        end
+      end
+
+      class TitleCollector < CollectorBase
+        def on_send(node)
+          if RuboCop::AST::NodePattern.new("(send nil? :title ...)").match(node)
+            # TODO - title may not be a simple string
+            memo[:title] = node.children[2].value
+          end
+        end
+      end
+
+      class TagCollector < CollectorBase
+
+        ACCPETABLE_TAG_TYPE_TO_VALUES = {
+          false: false,
+          true: true,
+          nil: nil,
+        }.freeze
+
+        def on_send(node)
+          if RuboCop::AST::NodePattern.new("(send nil? :tag ...)").match(node)
+            memo[:tags] ||= {}
+
+            node.children[2..-1].each do |tag_node|
+              collect_tags(tag_node)
+            end
+          end
+        end
+
+        private
+
+        def collect_tags(tag_node)
+          if tag_node.type == :str || tag_node.type == :sym
+            memo[:tags] = memo[:tags].merge(tag_node.value => nil)
+          elsif tag_node.type == :hash
+            tags_coll = {}
+            tag_node.children.each do |child_tag|
+              key = child_tag.key.value
+              if child_tag.value.type == :array
+                value = child_tag.value.children.map { |child_node| child_node.type == :str ? child_node.children.first : nil }
+              elsif ACCPETABLE_TAG_TYPE_TO_VALUES.key?(child_tag.value.type)
+                value = ACCPETABLE_TAG_TYPE_TO_VALUES[child_tag.value.type]
+              else
+                if child_tag.value.children.first.class == RuboCop::AST::SendNode
+                  # Cases like this: (where there is no assignment of the value to a variable like gcp_project_id)
+                  # tag project: gcp_project_id.to_s
+                  #
+                  # Lecacy evaluates gcp_project_id.to_s and then passes the value to the tag
+                  # We are not evaluating the value here, so we are just passing the value as it is
+                  #
+                  # TODO: Do we need to evaluate the value here?
+                  # (byebug) child_tag.value
+                  # s(:send,
+                  # s(:send, nil, :gcp_project_id), :to_s)
+                  value = child_tag.value.children.first.children[1]
+                elsif child_tag.value.children.first.class == RuboCop::AST::Node
+                  # Cases like this:
+                  # control_id = '1.1'
+                  # tag cis_gcp: control_id.to_s
+                  value = child_tag.value.children.first.children[0]
+                else
+                  value = child_tag.value.value
+                end
+              end
+              tags_coll.merge!(key => value)
+            end
+            memo[:tags] = memo[:tags].merge(tags_coll)
+          end
+        end
+      end
+
+      class RefCollector < CollectorBase
+        def on_send(node)
+          if RuboCop::AST::NodePattern.new("(send nil? :ref ...)").match(node)
+            # Construct the array of refs hash as below
+
+            # "refs": [
+            #   {
+            #     "url": "http://",
+            #     "ref": "Some ref"
+            #   },
+            #   {
+            #     "ref": "https://",
+            #   }
+            # ]
+
+            # node.children[1] && node.children[1] == :ref - we don't need this check as the pattern match above will take care of it
+            return unless node.children[2]
+
+            references = {}
+
+            if node.children[2].type == :begin
+              # Case for: ref   ({:ref=>"Some ref", :url=>"https://"})
+              # find the hash node
+              iterate_child_and_collect_ref(node.children[2].children, references)
+            elsif node.children[2].type == :str
+              # Case for: ref "ref1", url: "http://",
+              references.merge!(ref: node.children[2].value)
+              iterate_child_and_collect_ref(node.children[3..-1], references)
+            end
+
+            memo[:refs] ||= []
+            memo[:refs] << references
+          end
+        end
+
+        private
+
+        def iterate_child_and_collect_ref(child_node, references = {})
+          child_node.each do |ref_node|
+            if ref_node.type == :hash
+              iterate_hash_node(ref_node, references)
+            elsif ref_node.type == :str
+              references.merge!(ref_node.value => nil)
+            end
+          end
+        end
+
+        def iterate_hash_node(hash_node, references = {})
+          # hash node like this:
+          # s(:hash,
+          #   s(:pair,
+          #     s(:sym, :url),
+          #     s(:str, "https://")))
+          #
+          # or like this:
+          # (byebug) hash_node
+          # s(:hash,
+          # s(:pair,
+          #   s(:sym, :url),
+          #   s(:send,
+          #     s(:send, nil, :cis_url), :to_s)))
+          hash_node.children.each do |child_node|
+            if child_node.type == :pair
+              if child_node.value.children.first.class == RuboCop::AST::SendNode
+                # Case like this  (where there is no assignment of the value to a variable like cis_url)
+                # ref 'CIS Benchmark', url: cis_url.to_s
+                # Lecacy evaluates cis_url.to_s and then passes the value to the ref
+                # We are not evaluating the value here, so we are just passing the value as it is
+                #
+                # TODO: Do we need to evaluate the value here?
+                #
+                # (byebug) child_node.value.children.first
+                # s(:send, nil, :cis_url)
+                value = child_node.value.children.first.children[1]
+              elsif child_node.value.class == RuboCop::AST::SendNode
+                # Cases like this:
+                # cis_url = attribute('cis_url')
+                # ref 'CIS Benchmark', url: cis_url.to_s
+                value = child_node.value.children.first.children[0]
+              else
+                # Cases like this: ref 'CIS Benchmark - 2', url: "https://"
+                # require 'byebug'; byebug
+                value = child_node.value.value
+              end
+              references.merge!(child_node.key.value => value)
+            end
+          end
+        end
+      end
+
+      class ControlIDCollector < CollectorBase
+        attr_reader :seen_control_ids, :source_location_ref, :include_tests
+        def initialize(memo, source_location_ref, include_tests: false)
+          @memo = memo
+          @seen_control_ids = {}
+          @source_location_ref = source_location_ref
+          @include_tests = include_tests
+        end
+
+        def on_block(block_node)
+          if RuboCop::AST::NodePattern.new("(block (send nil? :control ...) ...)").match(block_node)
+            # NOTE: Assuming begin block is at the index 2
+            begin_block = block_node.children[2]
+            control_node = block_node.children[0]
+
+            # TODO - This assumes the control ID is always a plain string, which we know it is often not!
+            control_id = control_node.children[2].value
+            # TODO - BUG - this keeps seeing the same nodes over and over againa, and so repeating control IDs. We are ignoring duplicate control IDs, which is incorrect.
+            return if seen_control_ids[control_id]
+
+            seen_control_ids[control_id] = true
+
+            control_data = {
+              id: control_id,
+              code: block_node.source,
+              source_location: {
+                line: block_node.first_line,
+                ref: source_location_ref,
+              },
+              title: nil,
+              desc: nil,
+              descriptions: {},
+              impact: 0.5,
+              refs: [],
+              tags: {},
+            }
+            control_data[:checks] = [] if include_tests
+
+            # Scan the code block for per-control metadata
+            collectors = []
+            collectors.push ImpactCollector.new(control_data)
+            collectors.push DescCollector.new(control_data)
+            collectors.push TitleCollector.new(control_data)
+            collectors.push TagCollector.new(control_data)
+            collectors.push RefCollector.new(control_data)
+            collectors.push InputCollectorWithinControlBlock.new(@memo)
+            collectors.push TestsCollector.new(control_data) if include_tests
+
+            begin_block.each_node do |node_within_control|
+              collectors.each { |collector| collector.process(node_within_control) }
+            end
+
+            memo[:controls].push control_data
+          end
+        end
+      end
+
+      class InputCollectorWithinControlBlock < InputCollectorBase
+        def initialize(memo)
+          @memo = memo
+        end
+
+        def on_send(node)
+          check_and_collect_input(node)
+        end
+      end
+
+      class InputCollectorOutsideControlBlock < InputCollectorBase
+        def initialize(memo)
+          @memo = memo
+        end
+
+        # TODO: There is scope to refactor InputCollectorOutsideControlBlock and InputCollectorWithinControlBlock
+        # 1. We can have a single class for both the collectors
+        # 2. We can have a on_send and on_lvasgn method in the same class
+        # :lvasgn in ast stands for "local variable assignment"
+        def on_lvasgn(node)
+          # We are looking for the following pattern in the AST
+          # (lvasgn :var_name (send nil? :input ...))
+          # example: a = input('a') or a = input('a', value: 'b')
+          # and not this: a = 1
+          if RuboCop::AST::NodePattern.new("(lvasgn _ (send nil? :input ...))").match(node)
+            input_children = node.children[1]
+            collect_input(input_children)
+          end
+        end
+
+        def on_send(node)
+          check_and_collect_input(node)
+        end
+      end
+
+      class TestsCollector < CollectorBase
+
+        def on_block(node)
+          if RuboCop::AST::NodePattern.new("(block (send nil? :describe ...) ...)").match(node) ||
+              RuboCop::AST::NodePattern.new("(block (send nil? :expect ...) ...)").match(node)
+            memo[:checks] << node.source
+          end
+        end
+      end
+    end
+  end
+end

data/lib/inspec/version.rb

@@ -1,3 +1,3 @@
 module Inspec
-  VERSION = "5.22.29".freeze
+  VERSION = "6.6.0".freeze
 end

data/lib/inspec/waiver_file_reader.rb

@@ -15,49 +15,90 @@ module Inspec
       output = {}
 
       files.each do |file_path|
-        file_extension = File.extname(file_path)
-        data = nil
-        if [".yaml", ".yml"].include? file_extension
-          data = Secrets::YAML.resolve(file_path)
-          unless data.nil?
-            data = data.inputs
-            validate_json_yaml(data)
-          end
-        elsif file_extension == ".csv"
-          data = Waivers::CSVFileReader.resolve(file_path)
-          headers = Waivers::CSVFileReader.headers
-          validate_headers(headers)
-        elsif file_extension == ".json"
-          data = Waivers::JSONFileReader.resolve(file_path)
-          validate_json_yaml(data) unless data.nil?
-        end
+        data = read_from_file(file_path)
         output.merge!(data) if !data.nil? && data.is_a?(Hash)
 
         if data.nil?
           raise Inspec::Exceptions::WaiversFileNotReadable,
-              "Cannot find parser for waivers file '#{file_path}'. " \
+              "Cannot find parser for waivers file." \
               "Check to make sure file has the appropriate extension."
         end
+      rescue Inspec::Exceptions::WaiversFileNotReadable, Inspec::Exceptions::WaiversFileInvalidFormatting => e
+        Inspec::Log.error "Error reading waivers file #{file_path}. #{e.message}"
+        Inspec::UI.new.exit(:usage_error)
       end
 
       @waivers_data[profile_id] = output
     end
 
-    def self.validate_headers(headers, json_yaml = false)
-      required_fields = json_yaml ? %w{justification} : %w{control_id justification}
-      all_fields = %w{control_id justification expiration_date run}
+    def self.read_from_file(file_path)
+      data = nil
+      file_extension = File.extname(file_path)
+      if [".yaml", ".yml"].include? file_extension
+        data = Secrets::YAML.resolve(file_path)
+        data = data.inputs unless data.nil?
+        validate_json_yaml(data)
+      elsif file_extension == ".csv"
+        data = Waivers::CSVFileReader.resolve(file_path)
+        headers = Waivers::CSVFileReader.headers
+        validate_csv_headers(headers)
+      elsif file_extension == ".json"
+        data = Waivers::JSONFileReader.resolve(file_path)
+        validate_json_yaml(data) unless data.nil?
+      end
+      data
+    end
+
+    def self.all_fields
+      %w{control_id justification expiration_date run}
+    end
+
+    def self.validate_csv_headers(headers)
+      invalid_headers_info = fetch_invalid_headers_info(headers)
+      # Warn if blank column found in csv file
+      Inspec::Log.warn "Invalid column headers: Column can't be nil" if invalid_headers_info[:blank_column]
+      # Warn if extra header found in csv file
+      Inspec::Log.warn "Extra header/s #{invalid_headers_info[:extra_headers]}" unless invalid_headers_info[:extra_headers].empty?
+      unless invalid_headers_info[:missing_required_fields].empty?
+        raise Inspec::Exceptions::WaiversFileInvalidFormatting,
+        "Missing required header/s #{invalid_headers_info[:missing_required_fields]}. Fix headers in file to proceed."
+      end
+    end
 
-      Inspec::Log.warn "Missing column headers: #{(required_fields - headers)}" unless (required_fields - headers).empty?
-      Inspec::Log.warn "Invalid column header: Column can't be nil" if headers.include? nil
-      Inspec::Log.warn "Extra column headers: #{(headers - all_fields)}" unless (headers - all_fields).empty?
+    def self.fetch_invalid_headers_info(headers, json_yaml = false)
+      required_fields = json_yaml ? %w{justification} : %w{control_id justification}
+      data = {}
+      data[:missing_required_fields] = []
+      # Finds missing required fields
+      unless (required_fields - headers).empty?
+        data[:missing_required_fields] = required_fields - headers
+      end
+      # If column with no header found set the blank_column flag. Only applicable for csv
+      data[:blank_column] = headers.include?(nil) ? true : false
+      # Find extra headers/parameters
+      data[:extra_headers] = (headers - all_fields)
+      data
     end
 
     def self.validate_json_yaml(data)
-      headers = []
-      data.each_value do |value|
-        headers.push value.keys
+      missing_required_field = false
+      data.each do |key, value|
+        # In case of yaml or json we need to validate headers/parametes for each value
+        invalid_headers_info = fetch_invalid_headers_info(value.keys, true)
+        # WARN in case of extra parameters found in each waived control
+        Inspec::Log.warn "Control ID #{key}: extra parameter/s #{invalid_headers_info[:extra_headers]}" unless invalid_headers_info[:extra_headers].empty?
+        unless invalid_headers_info[:missing_required_fields].empty?
+          missing_required_field = true
+          # Log error for each waived control
+          Inspec::Log.error "Control ID #{key}: missing required parameter/s #{invalid_headers_info[:missing_required_fields]}"
+        end
+      end
+
+      # Raise error if any of the waived control has missing required filed
+      if missing_required_field
+        raise Inspec::Exceptions::WaiversFileInvalidFormatting,
+             "Missing required parameter [justification]. Fix parameters in file to proceed."
       end
-      validate_headers(headers.flatten.uniq, true)
     end
   end
 end