snyk 1.858.0 → 1.859.0

package/dist/cli/272.index.js

@@ -1479,6 +1479,24 @@ function terraformPlanReducer(scanInput, resource) {
     }
     return scanInput;
 }
+function getExpressions(expressions) {
+    const result = {};
+    // expressions can be nested. we are only doing 1 depth to resolve top level depenencies
+    for (const key of Object.keys(expressions)) {
+        const referenceKey = getReference(expressions[key]);
+        if (referenceKey) {
+            result[key] = referenceKey;
+        }
+    }
+    return result;
+}
+// this is very naive implementation
+// the referenences can be composed of number of keys
+// we only going to use the first reference for time being
+function getReference(value) {
+    var _a;
+    return (_a = value.references) === null || _a === void 0 ? void 0 : _a[0];
+}
 function getResourceName(index, name) {
     return index !== undefined ? `${name}["${index}"]` : name;
 }
@@ -1502,15 +1520,46 @@ function isValidResourceActions(action, isFullScan) {
         return validAction.every((field, idx) => action[idx] === field);
     });
 }
+function referencedResourcesResolver(scanInput, resources) {
+    var _a, _b;
+    // check root module for references in first depth of attributes
+    for (const resource of resources) {
+        const { type, name, mode, index, expressions } = resource;
+        // don't care about references in data sources for time being
+        if (mode == 'data') {
+            continue;
+        }
+        const inputKey = 'resource';
+        // only update the references in resources that have some resolved attributes already
+        const resolvedResource = (_b = (_a = scanInput[inputKey]) === null || _a === void 0 ? void 0 : _a[type]) === null || _b === void 0 ? void 0 : _b[getResourceName(index, name)];
+        if (resolvedResource) {
+            const resourceExpressions = getExpressions(expressions);
+            for (const key of Object.keys(resourceExpressions)) {
+                // only add non existing attributes. If we already have resolved value do not overwrite it with reference
+                if (!resolvedResource[key]) {
+                    resolvedResource[key] = resourceExpressions[key];
+                }
+            }
+            scanInput[inputKey][type][getResourceName(index, name)] = resolvedResource;
+        }
+    }
+    return scanInput;
+}
 function extractResourceChanges(terraformPlanJson) {
     return terraformPlanJson.resource_changes || [];
 }
+function extractReferencedResources(terraformPlanJson) {
+    var _a, _b;
+    return ((_b = (_a = terraformPlanJson.configuration) === null || _a === void 0 ? void 0 : _a.root_module) === null || _b === void 0 ? void 0 : _b.resources) || [];
+}
 function extractResourcesForScan(terraformPlanJson, isFullScan = false) {
     const resourceChanges = extractResourceChanges(terraformPlanJson);
-    return resourceChanges.reduce((memo, curr) => resourceChangeReducer(memo, curr, isFullScan), {
+    const scanInput = resourceChanges.reduce((memo, curr) => resourceChangeReducer(memo, curr, isFullScan), {
         resource: {},
         data: {},
     });
+    const referencedResources = extractReferencedResources(terraformPlanJson);
+    return referencedResourcesResolver(scanInput, referencedResources);
 }
 function isTerraformPlan(terraformPlanJson) {
     const missingRequiredFields = terraformPlanJson.resource_changes === undefined;