@skaleagents/swarm 0.6.14 → 0.6.15

package/dist/iac/parse.d.ts

@@ -33,5 +33,6 @@ export declare function looksLikeBicep(content: string): boolean;
 export declare function looksLikeArm(content: string): boolean;
 export declare function looksLikePulumiYaml(content: string): boolean;
 export declare function parseIac(content: string, requested?: IacFormat | "auto"): ParsedIac;
+export declare function terraformJsonencodeValue(expression: string): unknown | undefined;
 export declare function looksLikeServerless(content: string): boolean;
 export declare function looksLikeIamPolicy(content: string): boolean;

package/dist/iac/parse.js

@@ -139,7 +139,7 @@ export function looksLikePulumiYaml(content) {
     return (/^\s*resources\s*:/m.test(content) &&
         /^\s+type\s*:\s*[A-Za-z0-9_.-]+:\S+/m.test(content));
 }
-const terraformExpressionWarning = "Same-file variable and local literals are resolved. Functions and other expressions are not evaluated.";
+const terraformExpressionWarning = "Same-file variable and local literals are resolved. A string of those references and format of known literals are resolved. Other functions and expressions are not evaluated.";
 export function parseIac(content, requested = "auto") {
     if (!content.trim())
         throw new ScanInputError("Content must not be empty or whitespace.");
@@ -470,7 +470,7 @@ export function parseIac(content, requested = "auto") {
         warnings.push("No resources found in the submitted document.");
     if (format === "cloudformation" &&
         /(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\bRef\s*:)/.test(content))
-        warnings.push("Same-file parameter defaults are resolved. Functions are not evaluated.");
+        warnings.push("Same-file parameter defaults are resolved. A simple Fn::Sub of those parameters is resolved. Other functions are not evaluated.");
     else if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
         warnings.push("Intrinsic functions and expressions are not evaluated. Only literal configuration is checked.");
     return { format, resources, warnings };
@@ -1445,6 +1445,36 @@ function cloudFormationIntrinsic(value) {
         return false;
     return Object.keys(value).some((key) => key === "Fn::Sub" || key === "Fn::Join" || key === "Fn::FindInMap" || key.startsWith("Fn::"));
 }
+function cloudFormationSubTemplate(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const entries = Object.entries(value).filter(([key]) => key !== "__referencedSecrets");
+    if (entries.length !== 1)
+        return undefined;
+    const [key, template] = entries[0];
+    if (key !== "Fn::Sub" || typeof template !== "string")
+        return undefined;
+    return template;
+}
+function substituteKnownParameters(template, parameters) {
+    let unresolved = false;
+    let secret = false;
+    const text = template.replace(/\$\{(!?)([^}]*)\}/g, (full, literalMark, rawName) => {
+        if (literalMark === "!")
+            return `\${${rawName}}`;
+        const name = rawName.trim();
+        if (!parameters.defaults.has(name)) {
+            unresolved = true;
+            return full;
+        }
+        if (parameters.secretNames.has(name))
+            secret = true;
+        return String(parameters.defaults.get(name));
+    });
+    if (unresolved)
+        return undefined;
+    return { text, secret };
+}
 function resolveCloudFormationRefs(value, parameters) {
     const secretPaths = [];
     const resolved = resolveCloudFormationValue(value, parameters, [], secretPaths);
@@ -1472,6 +1502,15 @@ function resolveCloudFormationValue(value, parameters, path, secretPaths) {
             secretPaths.push(path);
         return literal;
     }
+    const subTemplate = cloudFormationSubTemplate(value);
+    if (subTemplate !== undefined) {
+        const substituted = substituteKnownParameters(subTemplate, parameters);
+        if (!substituted)
+            return value;
+        if (substituted.secret)
+            secretPaths.push(path);
+        return substituted.text;
+    }
     if (cloudFormationIntrinsic(value))
         return value;
     if (Array.isArray(value))
@@ -1487,6 +1526,20 @@ function resolveCloudFormationValue(value, parameters, path, secretPaths) {
     }
     return value;
 }
+export function terraformJsonencodeValue(expression) {
+    const match = /^\$\{jsonencode\(([\s\S]*)\)\}$/.exec(expression.trim());
+    if (!match)
+        return undefined;
+    try {
+        const [parsed, error] = hcl.parseToObject(`value = ${match[1]}\n`);
+        if (error || !parsed)
+            return undefined;
+        return object(parsed).value;
+    }
+    catch {
+        return undefined;
+    }
+}
 function terraformLocalBlocks(data) {
     const raw = object(data).locals;
     if (Array.isArray(raw))

package/dist/iac/rules.js

@@ -1,4 +1,4 @@
-import { array, object } from "./parse.js";
+import { array, object, terraformJsonencodeValue } from "./parse.js";
 import { externalHttp, literalCredential } from "../review.js";
 export const rules = {
     SEC001: {
@@ -40,8 +40,15 @@ export const rules = {
         category: "security",
         severity: "high",
         title: "Wildcard permission detected",
-        detail: "An Allow statement grants wildcard actions or principals.",
-        remediation: "List the required actions and trusted principals explicitly, with resource and condition restrictions.",
+        detail: "An Allow statement grants a wildcard action.",
+        remediation: "List the required actions explicitly, with resource and condition restrictions.",
+    },
+    IAM002: {
+        category: "security",
+        severity: "high",
+        title: "Policy allows any principal",
+        detail: "An Allow statement sets Principal to any AWS principal.",
+        remediation: "Name the trusted principals explicitly instead of allowing any principal.",
     },
     DATA001: {
         category: "security",
@@ -573,6 +580,150 @@ function checkTerraformLiterals(value, mode, check, path, name = "", referencedS
     }
 }
 const exactSameFileRef = /^\$\{(var|local)\.([A-Za-z_][A-Za-z0-9_]*)\}$/;
+const interpolationPiece = /\$\{(var|local)\.([A-Za-z_][A-Za-z0-9_]*)\}/g;
+const interpolationOnly = /^(\$\{(?:var|local)\.[A-Za-z_][A-Za-z0-9_]*\})+$/;
+function sameFileText(kind, name, sameFile) {
+    const literal = (kind === "var" ? sameFile.vars : sameFile.locals).get(name);
+    if (typeof literal === "string" || typeof literal === "number" || typeof literal === "boolean")
+        return String(literal);
+    return undefined;
+}
+function resolveInterpolationString(value, sameFile) {
+    const trimmed = value.trim();
+    if (!interpolationOnly.test(trimmed))
+        return undefined;
+    let count = 0;
+    let failed = false;
+    const text = trimmed.replace(interpolationPiece, (_full, kind, name) => {
+        count += 1;
+        const part = sameFileText(kind, name, sameFile);
+        if (part === undefined) {
+            failed = true;
+            return "";
+        }
+        return part;
+    });
+    if (failed || count < 2)
+        return undefined;
+    return text;
+}
+function splitCallArguments(source) {
+    const args = [];
+    let current = "";
+    let quote = null;
+    let depth = 0;
+    for (let index = 0; index < source.length; index += 1) {
+        const char = source[index];
+        if (quote) {
+            current += char;
+            if (char === "\\" && index + 1 < source.length) {
+                current += source[index + 1];
+                index += 1;
+                continue;
+            }
+            if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            quote = char;
+            current += char;
+            continue;
+        }
+        if (char === "(" || char === "[" || char === "{") {
+            depth += 1;
+            current += char;
+            continue;
+        }
+        if (char === ")" || char === "]" || char === "}") {
+            if (depth === 0)
+                return undefined;
+            depth -= 1;
+            current += char;
+            continue;
+        }
+        if (char === "," && depth === 0) {
+            args.push(current.trim());
+            current = "";
+            continue;
+        }
+        current += char;
+    }
+    if (quote || depth !== 0)
+        return undefined;
+    if (current.trim() !== "")
+        args.push(current.trim());
+    return args;
+}
+function unquoteHcl(token) {
+    if (token.length < 2)
+        return undefined;
+    const quote = token[0];
+    if ((quote !== '"' && quote !== "'") || token[token.length - 1] !== quote)
+        return undefined;
+    const body = token.slice(1, -1);
+    return quote === '"'
+        ? body.replace(/\\n/g, "\n").replace(/\\"/g, '"').replace(/\\\\/g, "\\")
+        : body.replace(/\\'/g, "'").replace(/\\\\/g, "\\");
+}
+function resolveFormatArgument(token, sameFile) {
+    const literal = unquoteHcl(token);
+    if (literal !== undefined)
+        return literal;
+    if (/^-?\d+(?:\.\d+)?$/.test(token) || token === "true" || token === "false")
+        return token;
+    const ref = /^(var|local)\.([A-Za-z_][A-Za-z0-9_]*)$/.exec(token);
+    if (!ref)
+        return undefined;
+    return sameFileText(ref[1], ref[2], sameFile);
+}
+function applyPercentS(format, args) {
+    let index = 0;
+    let text = "";
+    for (let cursor = 0; cursor < format.length; cursor += 1) {
+        if (format[cursor] !== "%") {
+            text += format[cursor];
+            continue;
+        }
+        const verb = format[cursor + 1];
+        if (verb === "%") {
+            text += "%";
+            cursor += 1;
+            continue;
+        }
+        if (verb !== "s" || index >= args.length)
+            return undefined;
+        text += args[index];
+        index += 1;
+        cursor += 1;
+    }
+    return text;
+}
+function resolveFormatCall(value, sameFile) {
+    const wrapped = /^\$\{format\(([\s\S]*)\)\}$/.exec(value.trim());
+    if (!wrapped)
+        return undefined;
+    const args = splitCallArguments(wrapped[1]);
+    if (!args || args.length === 0)
+        return undefined;
+    const resolved = [];
+    for (const arg of args) {
+        const part = resolveFormatArgument(arg, sameFile);
+        if (part === undefined)
+            return undefined;
+        resolved.push(part);
+    }
+    return applyPercentS(resolved[0], resolved.slice(1));
+}
+function noteResolvedLiteral(literal, path, sameFile, suppressed, referencedSecrets) {
+    if (literal.trim() === "")
+        return;
+    const key = [...path].reverse().find((part) => typeof part === "string");
+    if (sameFile.declaredSecrets.has(literal))
+        suppressed.add(path.join("."));
+    else if (typeof key === "string" && secretAssignmentName(key))
+        referencedSecrets.add(path.join("."));
+}
 function sameFileLiteral(value) {
     if (typeof value === "boolean" || typeof value === "number")
         return value;
@@ -610,19 +761,25 @@ function collectSameFileLiterals(resources) {
 function resolveSameFileRefs(value, sameFile, path, suppressed, referencedSecrets) {
     if (typeof value === "string") {
         const match = exactSameFileRef.exec(value.trim());
-        if (!match)
-            return value;
-        const literal = (match[1] === "var" ? sameFile.vars : sameFile.locals).get(match[2]);
-        if (literal === undefined)
-            return value;
-        if (typeof literal === "string" && literal.trim() !== "") {
-            const key = [...path].reverse().find((part) => typeof part === "string");
-            if (sameFile.declaredSecrets.has(literal))
-                suppressed.add(path.join("."));
-            else if (typeof key === "string" && secretAssignmentName(String(key)))
-                referencedSecrets.add(path.join("."));
+        if (match) {
+            const literal = (match[1] === "var" ? sameFile.vars : sameFile.locals).get(match[2]);
+            if (literal === undefined)
+                return value;
+            if (typeof literal === "string")
+                noteResolvedLiteral(literal, path, sameFile, suppressed, referencedSecrets);
+            return literal;
         }
-        return literal;
+        const concatenated = resolveInterpolationString(value, sameFile);
+        if (concatenated !== undefined) {
+            noteResolvedLiteral(concatenated, path, sameFile, suppressed, referencedSecrets);
+            return concatenated;
+        }
+        const formatted = resolveFormatCall(value, sameFile);
+        if (formatted !== undefined) {
+            noteResolvedLiteral(formatted, path, sameFile, suppressed, referencedSecrets);
+            return formatted;
+        }
+        return value;
     }
     if (Array.isArray(value)) {
         value.forEach((item, index) => {
@@ -705,6 +862,39 @@ function checkCompose(resource, check) {
         service.mem_reservation == null, ["mem_limit"]);
     check("NET001", array(service.ports).some(composePortIsPublic), ["ports"]);
 }
+function statementEffectAllows(body) {
+    const effect = body.Effect ?? body.effect;
+    if (effect == null || String(effect).trim() === "")
+        return true;
+    return String(effect).trim().toLowerCase() === "allow";
+}
+function principalAllowsAnyone(value) {
+    if (typeof value === "string")
+        return value.trim() === "*";
+    if (Array.isArray(value))
+        return value.some((item) => principalAllowsAnyone(item));
+    if (value && typeof value === "object")
+        return Object.values(value).some((item) => principalAllowsAnyone(item));
+    return false;
+}
+function actionIncludesWildcard(value) {
+    return array(value).some((item) => typeof item === "string" && item.includes("*"));
+}
+function checkInlinePolicy(document, check, path) {
+    const root = object(document);
+    const statements = root.Statement ?? root.statement;
+    if (!Array.isArray(statements) && (statements == null || typeof statements !== "object"))
+        return;
+    for (const statement of array(statements)) {
+        const body = object(statement);
+        if (!statementEffectAllows(body))
+            continue;
+        check("IAM001", actionIncludesWildcard(body.Action ?? body.action ?? body.Actions ?? body.actions), path);
+        const principal = body.Principal ?? body.principal ?? body.Principals ?? body.principals;
+        if (principal !== undefined)
+            check("IAM002", principalAllowsAnyone(principal), path);
+    }
+}
 function checkCloud(resource, resources, format, check) {
     const tf = format === "terraform";
     const pulumi = format === "pulumi";
@@ -727,31 +917,30 @@ function checkCloud(resource, resources, format, check) {
             isIngress) {
             check("NET001", array(child).some((cidr) => cidr === "0.0.0.0/0" || cidr === "::/0"), [...prefix, ...at]);
         }
-        if (/^(?:Action|Principal|actions|principals)$/.test(key) &&
-            (parent.Effect === "Allow" || parent.effect === "Allow")) {
-            const values = typeof child === "object" && !Array.isArray(child)
-                ? Object.values(object(child)).flatMap(array)
-                : array(child);
-            check("IAM001", values.some((item) => typeof item === "string" && item.includes("*")), [...prefix, ...at]);
-        }
-        if (/^(?:policy|assume_role_policy|PolicyDocument)$/.test(key) &&
-            typeof child === "string" &&
-            child.trimStart().startsWith("{")) {
-            try {
-                const document = JSON.parse(child);
-                for (const statement of array(object(document).Statement)) {
-                    const s = object(statement);
-                    check("IAM001", s.Effect === "Allow" &&
-                        [
-                            ...array(s.Action),
-                            ...array(s.Principal),
-                            ...Object.values(object(s.Principal)).flatMap(array),
-                        ].some((v) => typeof v === "string" && v.includes("*")), [...prefix, ...at]);
+        if (/^(?:Action|actions)$/.test(key) && statementEffectAllows(parent)) {
+            check("IAM001", actionIncludesWildcard(child), [...prefix, ...at]);
+        }
+        if (/^(?:Principal|principals)$/.test(key) && statementEffectAllows(parent)) {
+            check("IAM002", principalAllowsAnyone(child), [...prefix, ...at]);
+        }
+        if (typeof child === "string") {
+            const encoded = child.trim().startsWith("${jsonencode(")
+                ? terraformJsonencodeValue(child)
+                : undefined;
+            let parsed;
+            if (encoded === undefined &&
+                /^(?:policy|assume_role_policy|PolicyDocument)$/.test(key) &&
+                child.trimStart().startsWith("{")) {
+                try {
+                    parsed = JSON.parse(child);
+                }
+                catch {
+                    parsed = undefined;
                 }
             }
-            catch {
-                /* Nonliteral policies are covered by the expression warning. */
-            }
+            const document = encoded ?? parsed;
+            if (document !== undefined)
+                checkInlinePolicy(document, check, [...prefix, ...at]);
         }
         if (/^(?:instance_type|machine_type|vm_size|InstanceType|DBInstanceClass|instance_class)$/.test(key))
             check("COST001", typeof child === "string", [...prefix, ...at]);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.14";
+export declare const VERSION = "0.6.15";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.14";
+export const VERSION = "0.6.15";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.14",
+  "version": "0.6.15",
   "private": false,
   "publishConfig": {
     "access": "public"