@skaleagents/swarm 0.6.13 → 0.6.14

package/dist/iac/parse.js

@@ -139,7 +139,7 @@ export function looksLikePulumiYaml(content) {
     return (/^\s*resources\s*:/m.test(content) &&
         /^\s+type\s*:\s*[A-Za-z0-9_.-]+:\S+/m.test(content));
 }
-const terraformExpressionWarning = "Terraform expressions are not evaluated. Findings use literal values and declared settings.";
+const terraformExpressionWarning = "Same-file variable and local literals are resolved. Functions and other expressions are not evaluated.";
 export function parseIac(content, requested = "auto") {
     if (!content.trim())
         throw new ScanInputError("Content must not be empty or whitespace.");
@@ -412,11 +412,12 @@ export function parseIac(content, requested = "auto") {
                 Array.isArray(root.Resources) ||
                 typeof root.Resources !== "object")
                 throw new ScanInputError("CloudFormation requires a Resources mapping.");
+            const parameters = cloudFormationParameterLiterals(root);
             for (const [name, raw] of Object.entries(object(root.Resources))) {
                 const value = object(raw);
                 if (typeof value.Type !== "string")
                     throw new ScanInputError("Each CloudFormation resource requires a Type.");
-                add(name, value.Type, value, ["Resources", name]);
+                add(name, value.Type, resolveCloudFormationRefs(value, parameters), ["Resources", name]);
             }
         }
         else if (format === "terraform") {
@@ -467,7 +468,10 @@ export function parseIac(content, requested = "auto") {
         throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, Docker Compose, a Dockerfile, a GitHub Actions workflow, a Helm template, an Ansible playbook, Bicep, an ARM template, Serverless Framework, or a standalone IAM policy.");
     if (!resources.length)
         warnings.push("No resources found in the submitted document.");
-    if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
+    if (format === "cloudformation" &&
+        /(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\bRef\s*:)/.test(content))
+        warnings.push("Same-file parameter defaults are resolved. Functions are not evaluated.");
+    else if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
         warnings.push("Intrinsic functions and expressions are not evaluated. Only literal configuration is checked.");
     return { format, resources, warnings };
 }
@@ -1403,6 +1407,86 @@ function parseAzure(content, format) {
         warnings: [azureExpressionWarning],
     };
 }
+function parameterNameIsSecret(name) {
+    const normalized = name.replace(/-/g, "_");
+    return (/(?:^|_)(?:password|passwd|secret|token)$/i.test(normalized) ||
+        /(?:^|_)(?:api_?key|auth_token|access_key|private_key)$/i.test(normalized) ||
+        /(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?key|private[_-]?key|token)$/i.test(name));
+}
+function cloudFormationParameterLiterals(root) {
+    const defaults = new Map();
+    const secretNames = new Set();
+    for (const [name, raw] of Object.entries(object(root.Parameters))) {
+        const body = object(raw);
+        if (!("Default" in body))
+            continue;
+        const value = body.Default;
+        if (typeof value !== "string" && typeof value !== "boolean" && typeof value !== "number")
+            continue;
+        defaults.set(name, value);
+        if (typeof value === "string" && value.trim() !== "" && parameterNameIsSecret(name))
+            secretNames.add(name);
+    }
+    return { defaults, secretNames };
+}
+function cloudFormationRefName(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const entries = Object.entries(value).filter(([key]) => key !== "__referencedSecrets");
+    if (entries.length !== 1)
+        return undefined;
+    const [key, name] = entries[0];
+    if (key !== "Ref" || typeof name !== "string" || name.trim() === "")
+        return undefined;
+    return name;
+}
+function cloudFormationIntrinsic(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    return Object.keys(value).some((key) => key === "Fn::Sub" || key === "Fn::Join" || key === "Fn::FindInMap" || key.startsWith("Fn::"));
+}
+function resolveCloudFormationRefs(value, parameters) {
+    const secretPaths = [];
+    const resolved = resolveCloudFormationValue(value, parameters, [], secretPaths);
+    if (secretPaths.length > 0 &&
+        resolved &&
+        typeof resolved === "object" &&
+        !Array.isArray(resolved)) {
+        Object.defineProperty(resolved, "__referencedSecrets", {
+            enumerable: false,
+            configurable: true,
+            value: secretPaths,
+        });
+    }
+    return object(resolved);
+}
+function resolveCloudFormationValue(value, parameters, path, secretPaths) {
+    const ref = cloudFormationRefName(value);
+    if (ref) {
+        if (!parameters.defaults.has(ref))
+            return value;
+        const literal = parameters.defaults.get(ref);
+        if (parameters.secretNames.has(ref) &&
+            typeof literal === "string" &&
+            literal.trim() !== "")
+            secretPaths.push(path);
+        return literal;
+    }
+    if (cloudFormationIntrinsic(value))
+        return value;
+    if (Array.isArray(value))
+        return value.map((item, index) => resolveCloudFormationValue(item, parameters, [...path, index], secretPaths));
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [key, child] of Object.entries(value)) {
+            if (key === "__referencedSecrets")
+                continue;
+            out[key] = resolveCloudFormationValue(child, parameters, [...path, key], secretPaths);
+        }
+        return out;
+    }
+    return value;
+}
 function terraformLocalBlocks(data) {
     const raw = object(data).locals;
     if (Array.isArray(raw))
@@ -1443,8 +1527,8 @@ export function looksLikeIamPolicy(content) {
     const statement = root.Statement ?? root.statement;
     return Array.isArray(statement);
 }
-const serverlessWarning = "The Serverless Framework config is not executed. Conditions are not evaluated.";
-const iamPolicyWarning = "The IAM policy is not executed. Conditions are not evaluated.";
+const serverlessWarning = "The Serverless Framework config is not executed. Other condition operators are not evaluated.";
+const iamPolicyWarning = "The IAM policy is not executed. Other condition operators are not evaluated.";
 function serverlessShapeError() {
     return "Serverless Framework config requires top-level service and provider, plus functions or plugins.";
 }
@@ -1457,6 +1541,29 @@ function effectAllows(body) {
         return true;
     return String(effect).trim().toLowerCase() === "allow";
 }
+const openSourceAddresses = new Set(["0.0.0.0/0", "::/0", "*"]);
+function conditionValueIsOpen(value) {
+    if (typeof value === "string")
+        return openSourceAddresses.has(value.trim());
+    if (Array.isArray(value))
+        return value.some((item) => conditionValueIsOpen(item));
+    return false;
+}
+function sourceAddressAllowsEveryone(body) {
+    if (!effectAllows(body))
+        return false;
+    const condition = object(body.Condition ?? body.condition);
+    let ipAddress;
+    for (const [key, value] of Object.entries(condition)) {
+        if (key.toLowerCase() === "ipaddress") {
+            ipAddress = value;
+            break;
+        }
+    }
+    if (!ipAddress || typeof ipAddress !== "object" || Array.isArray(ipAddress))
+        return false;
+    return Object.values(object(ipAddress)).some((value) => conditionValueIsOpen(value));
+}
 function actionIsOnlyWildcard(body) {
     const action = body.Action ?? body.action ?? body.actions ?? body.Actions;
     if (typeof action === "string")
@@ -1531,14 +1638,16 @@ function parseServerless(content) {
     for (const group of statementGroups(root)) {
         group.statements.forEach((statement, index) => {
             const body = object(statement);
-            if (!effectAllows(body) || !actionIsOnlyWildcard(body))
+            const wildcard = effectAllows(body) && actionIsOnlyWildcard(body);
+            const openSourceIp = sourceAddressAllowsEveryone(body);
+            if (!wildcard && !openSourceIp)
                 return;
             iamCount += 1;
-            const path = [...group.path, index, "Action"];
+            const path = [...group.path, index, openSourceIp && !wildcard ? "Condition" : "Action"];
             resources.push({
                 id: `serverless.iam.${iamCount}`,
                 type: "serverless:iam",
-                value: { wildcard: true },
+                value: { wildcard, openSourceIp },
                 locate: () => yamlLocation(doc, lines, path),
             });
         });
@@ -1599,14 +1708,18 @@ function parseIamPolicy(content) {
     const resources = [];
     statements.forEach((statement, index) => {
         const body = object(statement);
-        if (!effectAllows(body) || !actionIsOnlyWildcard(body))
+        const wildcard = effectAllows(body) && actionIsOnlyWildcard(body);
+        const openSourceIp = sourceAddressAllowsEveryone(body);
+        if (!wildcard && !openSourceIp)
             return;
-        const line = iamStatementLine(content, index);
+        const line = iamStatementLine(content, index, openSourceIp && !wildcard ? "Condition" : "Action");
         resources.push({
             id: `iam.statement.${index + 1}`,
             type: "iam:statement",
-            value: { wildcard: true },
-            locate: () => lineLocation(line, `Statement.${index}.Action`),
+            value: { wildcard, openSourceIp },
+            locate: () => lineLocation(line, openSourceIp && !wildcard
+                ? `Statement.${index}.Condition`
+                : `Statement.${index}.Action`),
         });
     });
     if (!resources.length) {
@@ -1619,13 +1732,13 @@ function parseIamPolicy(content) {
     }
     return { format: "iam", resources, warnings: [iamPolicyWarning] };
 }
-function iamStatementLine(content, index) {
+function iamStatementLine(content, index, key = "Action") {
     const matches = [...content.matchAll(/"Statement"\s*:/g)];
     const start = matches[0]?.index ?? 0;
     const region = content.slice(start);
-    const actions = [...region.matchAll(/"Action"\s*:/g)];
-    const action = actions[index];
-    if (!action || action.index == null)
+    const keys = [...region.matchAll(new RegExp(`"${key}"\\s*:`, "g"))];
+    const hit = key === "Action" ? keys[index] : keys.find((item) => item.index != null);
+    if (!hit || hit.index == null)
         return lineAt(content, start);
-    return lineAt(content, start + action.index);
+    return lineAt(content, start + hit.index);
 }

package/dist/iac/rules.js

@@ -369,6 +369,22 @@ export const rules = {
 export function resourceFindings(resources, format) {
     const findings = [];
     const checked = new Set();
+    const sameFile = collectSameFileLiterals(resources);
+    const suppressedSecrets = new WeakMap();
+    const moduleSecrets = new WeakMap();
+    if (format === "terraform") {
+        for (const resource of resources) {
+            if (resource.type === "terraform:variable" ||
+                resource.type === "terraform:local" ||
+                resource.type === "tfvars:assignment")
+                continue;
+            const suppressed = new Set();
+            const referenced = new Set();
+            resolveSameFileRefs(resource.value, sameFile, [], suppressed, referenced);
+            suppressedSecrets.set(resource, suppressed);
+            moduleSecrets.set(resource, referenced);
+        }
+    }
     for (const resource of resources) {
         const check = (id, condition, path = []) => {
             checked.add(id);
@@ -412,6 +428,7 @@ export function resourceFindings(resources, format) {
         }
         if (format === "iam") {
             check("IAM001", resource.value.wildcard === true, ["Action"]);
+            check("NET001", resource.value.openSourceIp === true, ["Condition"]);
             continue;
         }
         if (resource.type === "terraform:local") {
@@ -419,7 +436,7 @@ export function resourceFindings(resources, format) {
             continue;
         }
         if (resource.type === "terraform:module") {
-            checkTerraformLiterals(resource.value, "module", check, []);
+            checkTerraformLiterals(resource.value, "module", check, [], "", moduleSecrets.get(resource));
             continue;
         }
         if (resource.type === "terraform:variable") {
@@ -436,7 +453,8 @@ export function resourceFindings(resources, format) {
             const credentialName = /(?:password|passwd|secret|api[_-]?key|auth[_-]?token)$/i;
             check("SEC001", (credentialName.test(key) ||
                 (key === "value" && credentialName.test(String(parent.name)))) &&
-                literalCredential(value), path);
+                literalCredential(value) &&
+                !suppressedSecrets.get(resource)?.has(path.join(".")), path);
             check("SEC002", /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/.test(value), path);
             check("SEC003", /-----BEGIN (?:RSA |EC |OPENSSH |DSA |)PRIVATE KEY-----/.test(value), path);
             check("NET002", [...value.matchAll(/\bhttp:\/\/[^\s"'<>]+/gi)].some((m) => externalHttp(m[0])), path);
@@ -447,8 +465,15 @@ export function resourceFindings(resources, format) {
             checkCompose(resource, check);
         else
             checkCloud(resource, resources, format, check);
+        const referencedSecrets = Object.getOwnPropertyDescriptor(resource.value, "__referencedSecrets")?.value;
+        if (Array.isArray(referencedSecrets)) {
+            for (const secretPath of referencedSecrets) {
+                if (Array.isArray(secretPath))
+                    check("SEC001", true, secretPath);
+            }
+        }
     }
-    return { findings, checked };
+    return { findings: dedupeSecretFindings(findings), checked };
 }
 function checkDockerfile(resource, check) {
     if (resource.type === "dockerfile:user")
@@ -500,8 +525,10 @@ function checkPipeline(resource, check) {
         check("PIPE003", resource.value.present === true, ["privileged"]);
 }
 function checkServerless(resource, check) {
-    if (resource.type === "serverless:iam")
+    if (resource.type === "serverless:iam") {
         check("IAM001", resource.value.wildcard === true, ["Action"]);
+        check("NET001", resource.value.openSourceIp === true, ["Condition"]);
+    }
     else if (resource.type === "serverless:env")
         check("SLS001", resource.value.literal === true, ["environment"]);
 }
@@ -520,7 +547,7 @@ function moduleCidrExempt(name) {
         normalized === "destination" ||
         normalized === "ipv6_egress");
 }
-function checkTerraformLiterals(value, mode, check, path, name = "") {
+function checkTerraformLiterals(value, mode, check, path, name = "", referencedSecrets) {
     if (typeof value === "string" || typeof value === "boolean") {
         const open = value === "0.0.0.0/0" || value === "::/0";
         const exempt = mode === "assignment" ? name.toLowerCase() === "egress" : moduleCidrExempt(name);
@@ -532,16 +559,97 @@ function checkTerraformLiterals(value, mode, check, path, name = "") {
             check("TF001", value.trim() !== "" && !terraformReference(value), path);
         if (mode === "local" && typeof value === "string" && secretAssignmentName(name))
             check("TF002", value.trim() !== "" && !terraformReference(value), path);
+        if (mode === "module" && referencedSecrets?.has(path.join(".")))
+            check("SEC001", true, path);
         return;
     }
     if (Array.isArray(value)) {
-        value.forEach((item, index) => checkTerraformLiterals(item, mode, check, [...path, index], name));
+        value.forEach((item, index) => checkTerraformLiterals(item, mode, check, [...path, index], name, referencedSecrets));
         return;
     }
     if (value && typeof value === "object") {
         for (const [key, child] of Object.entries(value))
-            checkTerraformLiterals(child, mode, check, [...path, key], key);
+            checkTerraformLiterals(child, mode, check, [...path, key], key, referencedSecrets);
+    }
+}
+const exactSameFileRef = /^\$\{(var|local)\.([A-Za-z_][A-Za-z0-9_]*)\}$/;
+function sameFileLiteral(value) {
+    if (typeof value === "boolean" || typeof value === "number")
+        return value;
+    if (typeof value === "string" && !value.includes("${"))
+        return value;
+    return undefined;
+}
+function collectSameFileLiterals(resources) {
+    const vars = new Map();
+    const locals = new Map();
+    const declaredSecrets = new Set();
+    for (const resource of resources) {
+        if (resource.type === "terraform:variable") {
+            const name = String(resource.value.name ?? "");
+            const literal = sameFileLiteral(resource.value.default);
+            if (!name || literal === undefined)
+                continue;
+            vars.set(name, literal);
+            if (typeof literal === "string" && literal.trim() !== "" && secretAssignmentName(name))
+                declaredSecrets.add(literal);
+        }
+        if (resource.type === "terraform:local") {
+            for (const [name, raw] of Object.entries(resource.value)) {
+                const literal = sameFileLiteral(raw);
+                if (literal === undefined)
+                    continue;
+                locals.set(name, literal);
+                if (typeof literal === "string" && literal.trim() !== "" && secretAssignmentName(name))
+                    declaredSecrets.add(literal);
+            }
+        }
     }
+    return { vars, locals, declaredSecrets };
+}
+function resolveSameFileRefs(value, sameFile, path, suppressed, referencedSecrets) {
+    if (typeof value === "string") {
+        const match = exactSameFileRef.exec(value.trim());
+        if (!match)
+            return value;
+        const literal = (match[1] === "var" ? sameFile.vars : sameFile.locals).get(match[2]);
+        if (literal === undefined)
+            return value;
+        if (typeof literal === "string" && literal.trim() !== "") {
+            const key = [...path].reverse().find((part) => typeof part === "string");
+            if (sameFile.declaredSecrets.has(literal))
+                suppressed.add(path.join("."));
+            else if (typeof key === "string" && secretAssignmentName(String(key)))
+                referencedSecrets.add(path.join("."));
+        }
+        return literal;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => {
+            value[index] = resolveSameFileRefs(item, sameFile, [...path, index], suppressed, referencedSecrets);
+        });
+        return value;
+    }
+    if (value && typeof value === "object") {
+        for (const [key, child] of Object.entries(value)) {
+            if (key === "__referencedSecrets")
+                continue;
+            value[key] = resolveSameFileRefs(child, sameFile, [...path, key], suppressed, referencedSecrets);
+        }
+    }
+    return value;
+}
+function dedupeSecretFindings(findings) {
+    const seen = new Set();
+    return findings.filter((finding) => {
+        if (finding.ruleId !== "SEC001")
+            return true;
+        const key = `${finding.ruleId}|${finding.resource}|${finding.location?.path ?? ""}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
 }
 function checkAzure(resource, check) {
     if (resource.type === "azure:exposure")

package/dist/iac/scan.js

@@ -55,6 +55,11 @@ export function scanIac(content, options = {}) {
                     "HCL locations point to resource declarations; property paths identify the affected setting.",
                 ]
                 : []),
+            ...(parsed.format === "terraform" || parsed.format === "cloudformation"
+                ? [
+                    "Same-file var, local, and CloudFormation parameter defaults are resolved. Functions, Fn::Sub, and module sources are not.",
+                ]
+                : []),
         ],
     };
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.13";
+export declare const VERSION = "0.6.14";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.13";
+export const VERSION = "0.6.14";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.13",
+  "version": "0.6.14",
   "private": false,
   "publishConfig": {
     "access": "public"