snyk 1.967.0 → 1.968.0

package/dist/cli/917.index.js

@@ -79,12 +79,12 @@ async function default_1(...args) {
         options,
         isNewIacOutputSupported,
     });
+    const projectRoot = process.cwd();
     output_1.printHeader({
-        paths,
         options,
         isNewIacOutputSupported,
     });
-    const { iacOutputMeta, iacScanFailures, iacIgnoredIssuesCount, results, resultOptions, } = await scan_1.scan(iacOrgSettings, options, testSpinner, paths, orgPublicId, buildOciRegistry);
+    const { iacOutputMeta, iacScanFailures, iacIgnoredIssuesCount, results, resultOptions, } = await scan_1.scan(iacOrgSettings, options, testSpinner, paths, orgPublicId, buildOciRegistry, projectRoot);
     return output_1.buildOutput({
         results,
         options,
@@ -697,11 +697,10 @@ exports.InvalidVarFilePath = InvalidVarFilePath;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.pull = exports.localTest = exports.cleanLocalCache = exports.trackUsage = exports.formatScanResultsV2 = exports.formatScanResultsV1 = exports.applyCustomSeverities = exports.getIacOrgSettings = exports.scanFiles = exports.parseFiles = exports.loadContentForFiles = exports.initLocalCache = exports.performanceAnalyticsDecorator = exports.asyncPerformanceAnalyticsDecorator = void 0;
+exports.pull = exports.localTest = exports.cleanLocalCache = exports.trackUsage = exports.formatScanResultsV2 = exports.applyCustomSeverities = exports.getIacOrgSettings = exports.scanFiles = exports.parseFiles = exports.loadContentForFiles = exports.initLocalCache = exports.performanceAnalyticsDecorator = exports.asyncPerformanceAnalyticsDecorator = void 0;
 const file_parser_1 = __webpack_require__(39331);
 const file_scanner_1 = __webpack_require__(88361);
-const results_formatter_1 = __webpack_require__(47354);
-const results_formatter_2 = __webpack_require__(50350);
+const results_formatter_1 = __webpack_require__(11059);
 const usage_tracking_1 = __webpack_require__(70413);
 const local_cache_1 = __webpack_require__(50089);
 const apply_custom_severities_1 = __webpack_require__(71632);
@@ -748,10 +747,8 @@ const measurableApplyCustomSeverities = asyncPerformanceAnalyticsDecorator(apply
 exports.applyCustomSeverities = measurableApplyCustomSeverities;
 const measurableCleanLocalCache = performanceAnalyticsDecorator(local_cache_1.cleanLocalCache, types_1.PerformanceAnalyticsKey.CacheCleanup);
 exports.cleanLocalCache = measurableCleanLocalCache;
-const measurableFormatScanResultsV1 = performanceAnalyticsDecorator(results_formatter_1.formatScanResults, types_1.PerformanceAnalyticsKey.ResultFormatting);
-exports.formatScanResultsV1 = measurableFormatScanResultsV1;
-const measurableFormatScanResultsV2 = performanceAnalyticsDecorator(results_formatter_2.formatScanResults, types_1.PerformanceAnalyticsKey.ResultFormatting);
-exports.formatScanResultsV2 = measurableFormatScanResultsV2;
+const measurableFormatScanResults = performanceAnalyticsDecorator(results_formatter_1.formatScanResults, types_1.PerformanceAnalyticsKey.ResultFormatting);
+exports.formatScanResultsV2 = measurableFormatScanResults;
 const measurableTrackUsage = asyncPerformanceAnalyticsDecorator(usage_tracking_1.trackUsage, types_1.PerformanceAnalyticsKey.UsageTracking);
 exports.trackUsage = measurableTrackUsage;
 const measurableLocalTest = asyncPerformanceAnalyticsDecorator(index_1.test, types_1.PerformanceAnalyticsKey.Total);
@@ -933,550 +930,107 @@ function getReference(value) {
     var _a;
     return (_a = value.references) === null || _a === void 0 ? void 0 : _a[0];
 }
-function getResourceName(index, name) {
-    return index !== undefined ? `${name}["${index}"]` : name;
-}
-function resourceChangeReducer(scanInput, resource, isFullScan) {
-    // TODO: investigate if we need to address also `after_unknown` field.
-    const { actions, after } = resource.change || { actions: [], after: {} };
-    if (isValidResourceActions(actions, isFullScan)) {
-        const resourceForReduction = { ...resource, values: after || {} };
-        return terraformPlanReducer(scanInput, resourceForReduction);
-    }
-    return scanInput;
-}
-function isValidResourceActions(action, isFullScan) {
-    const VALID_ACTIONS = isFullScan
-        ? types_1.VALID_RESOURCE_ACTIONS_FOR_FULL_SCAN
-        : types_1.VALID_RESOURCE_ACTIONS_FOR_DELTA_SCAN;
-    return VALID_ACTIONS.some((validAction) => {
-        if (action.length !== validAction.length) {
-            return false;
-        }
-        return validAction.every((field, idx) => action[idx] === field);
-    });
-}
-function referencedResourcesResolver(scanInput, resources) {
-    var _a, _b;
-    // check root module for references in first depth of attributes
-    for (const resource of resources) {
-        const { type, name, mode, index, expressions } = resource;
-        // don't care about references in data sources for time being
-        if (mode == 'data') {
-            continue;
-        }
-        const inputKey = 'resource';
-        // only update the references in resources that have some resolved attributes already
-        const resolvedResource = (_b = (_a = scanInput[inputKey]) === null || _a === void 0 ? void 0 : _a[type]) === null || _b === void 0 ? void 0 : _b[getResourceName(index, name)];
-        if (resolvedResource && expressions) {
-            const resourceExpressions = getExpressions(expressions);
-            for (const key of Object.keys(resourceExpressions)) {
-                // only add non existing attributes. If we already have resolved value do not overwrite it with reference
-                if (!resolvedResource[key]) {
-                    resolvedResource[key] = resourceExpressions[key];
-                }
-            }
-            scanInput[inputKey][type][getResourceName(index, name)] = resolvedResource;
-        }
-    }
-    return scanInput;
-}
-function extractResourceChanges(terraformPlanJson) {
-    return terraformPlanJson.resource_changes || [];
-}
-function extractReferencedResources(terraformPlanJson) {
-    var _a, _b;
-    return ((_b = (_a = terraformPlanJson.configuration) === null || _a === void 0 ? void 0 : _a.root_module) === null || _b === void 0 ? void 0 : _b.resources) || [];
-}
-function extractResourcesForScan(terraformPlanJson, isFullScan = false) {
-    const resourceChanges = extractResourceChanges(terraformPlanJson);
-    const scanInput = resourceChanges.reduce((memo, curr) => resourceChangeReducer(memo, curr, isFullScan), {
-        resource: {},
-        data: {},
-    });
-    const referencedResources = extractReferencedResources(terraformPlanJson);
-    return referencedResourcesResolver(scanInput, referencedResources);
-}
-function isTerraformPlan(terraformPlanJson) {
-    const missingRequiredFields = terraformPlanJson.resource_changes === undefined;
-    return !missingRequiredFields;
-}
-exports.isTerraformPlan = isTerraformPlan;
-function tryParsingTerraformPlan(terraformPlanFile, terraformPlanJson, { isFullScan } = { isFullScan: false }) {
-    try {
-        return [
-            {
-                ...terraformPlanFile,
-                jsonContent: extractResourcesForScan(terraformPlanJson, isFullScan),
-                engineType: types_1.EngineType.Terraform,
-                projectType: constants_1.IacProjectType.TERRAFORM,
-            },
-        ];
-    }
-    catch (err) {
-        throw new FailedToExtractResourcesInTerraformPlanError();
-    }
-}
-exports.tryParsingTerraformPlan = tryParsingTerraformPlan;
-// This error is due to the complex reduction logic, so it catches scenarios we might have not covered.
-class FailedToExtractResourcesInTerraformPlanError extends errors_1.CustomError {
-    constructor(message) {
-        super(message || 'Failed to extract resources from Terraform plan JSON file');
-        this.code = types_1.IaCErrorCodes.FailedToExtractResourcesInTerraformPlanError;
-        this.strCode = error_utils_1.getErrorStringCode(this.code);
-        this.userMessage =
-            'We failed to extract resource changes from the Terraform plan file, please contact support@snyk.io, if possible with a redacted version of the file';
-    }
-}
-exports.FailedToExtractResourcesInTerraformPlanError = FailedToExtractResourcesInTerraformPlanError;
-
-
-/***/ }),
-
-/***/ 1229:
-/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.MultipleGroupsResultsProcessor = exports.SingleGroupResultsProcessor = void 0;
-const v2_1 = __webpack_require__(89324);
-const v1_1 = __webpack_require__(97884);
-class SingleGroupResultsProcessor {
-    constructor(projectRoot, orgPublicId, iacOrgSettings, options) {
-        this.projectRoot = projectRoot;
-        this.orgPublicId = orgPublicId;
-        this.iacOrgSettings = iacOrgSettings;
-        this.options = options;
-    }
-    processResults(resultsWithCustomSeverities, policy, tags, attributes) {
-        return v2_1.processResults(resultsWithCustomSeverities, this.orgPublicId, this.iacOrgSettings, policy, tags, attributes, this.options, this.projectRoot);
-    }
-}
-exports.SingleGroupResultsProcessor = SingleGroupResultsProcessor;
-class MultipleGroupsResultsProcessor {
-    constructor(pathToScan, orgPublicId, iacOrgSettings, options) {
-        this.pathToScan = pathToScan;
-        this.orgPublicId = orgPublicId;
-        this.iacOrgSettings = iacOrgSettings;
-        this.options = options;
-    }
-    processResults(resultsWithCustomSeverities, policy, tags, attributes) {
-        return v1_1.processResults(resultsWithCustomSeverities, this.orgPublicId, this.iacOrgSettings, policy, tags, attributes, this.options, this.pathToScan);
-    }
-}
-exports.MultipleGroupsResultsProcessor = MultipleGroupsResultsProcessor;
-
-
-/***/ }),
-
-/***/ 29576:
-/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.extractLineNumber = exports.getFileTypeForParser = void 0;
-const types_1 = __webpack_require__(94820);
-const errors_1 = __webpack_require__(55191);
-const cloud_config_parser_1 = __webpack_require__(98611);
-const file_parser_1 = __webpack_require__(39331);
-const analytics = __webpack_require__(82744);
-const Debug = __webpack_require__(15158);
-const error_utils_1 = __webpack_require__(36401);
-const debug = Debug('iac-extract-line-number');
-function getFileTypeForParser(fileType) {
-    switch (fileType) {
-        case 'yaml':
-        case 'yml':
-            return cloud_config_parser_1.CloudConfigFileTypes.YAML;
-        case 'json':
-            return cloud_config_parser_1.CloudConfigFileTypes.JSON;
-        case 'tf':
-            return cloud_config_parser_1.CloudConfigFileTypes.TF;
-        default:
-            throw new file_parser_1.UnsupportedFileTypeError(fileType);
-    }
-}
-exports.getFileTypeForParser = getFileTypeForParser;
-function extractLineNumber(cloudConfigPath, fileType, treeByDocId) {
-    try {
-        return cloud_config_parser_1.getLineNumber(cloudConfigPath, fileType, treeByDocId);
-    }
-    catch {
-        const err = new FailedToExtractLineNumberError();
-        analytics.add('error-code', err.code);
-        debug('Parser library failed. Could not assign lineNumber to issue');
-        return -1;
-    }
-}
-exports.extractLineNumber = extractLineNumber;
-class FailedToExtractLineNumberError extends errors_1.CustomError {
-    constructor(message) {
-        super(message || 'Parser library failed. Could not assign lineNumber to issue');
-        this.code = types_1.IaCErrorCodes.FailedToExtractLineNumberError;
-        this.strCode = error_utils_1.getErrorStringCode(this.code);
-        this.userMessage = ''; // Not a user facing error.
-    }
-}
-
-
-/***/ }),
-
-/***/ 97884:
-/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.processResults = void 0;
-const policy_1 = __webpack_require__(31748);
-const share_results_1 = __webpack_require__(20588);
-const measurable_methods_1 = __webpack_require__(5687);
-async function processResults(resultsWithCustomSeverities, orgPublicId, iacOrgSettings, policy, tags, attributes, options, pathToScan) {
-    let projectPublicIds = {};
-    let gitRemoteUrl;
-    if (options.report) {
-        ({ projectPublicIds, gitRemoteUrl } = await share_results_1.formatAndShareResults({
-            results: resultsWithCustomSeverities,
-            options,
-            orgPublicId,
-            policy,
-            tags,
-            attributes,
-            pathToScan,
-        }));
-    }
-    const formattedResults = measurable_methods_1.formatScanResultsV1(resultsWithCustomSeverities, options, iacOrgSettings.meta, projectPublicIds, gitRemoteUrl);
-    return policy_1.filterIgnoredIssues(policy, formattedResults);
-}
-exports.processResults = processResults;
-
-
-/***/ }),
-
-/***/ 31748:
-/***/ ((__unused_webpack_module, exports) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.filterIgnoredIssues = void 0;
-function filterIgnoredIssues(policy, results) {
-    if (!policy) {
-        return { filteredIssues: results, ignoreCount: 0 };
-    }
-    const vulns = results.map((res) => policy.filter(toIaCVulnAdapter(res), undefined, 'exact'));
-    const ignoreCount = vulns.reduce((totalIgnored, vuln) => totalIgnored + vuln.filtered.ignore.length, 0);
-    const filteredIssues = vulns.map((vuln) => toFormattedResult(vuln));
-    return { filteredIssues, ignoreCount };
-}
-exports.filterIgnoredIssues = filterIgnoredIssues;
-function toIaCVulnAdapter(result) {
-    return {
-        vulnerabilities: result.result.cloudConfigResults.map((cloudConfigResult) => {
-            const annotatedResult = cloudConfigResult;
-            // Copy the cloudConfigPath array to avoid modifying the original with
-            // splice.
-            // Insert the targetFile into the path so that it is taken into account
-            // when determining whether an ignore rule should be applied.
-            const path = [...annotatedResult.cloudConfigPath];
-            path.splice(0, 0, result.targetFile);
-            return {
-                id: cloudConfigResult.id,
-                from: path,
-            };
-        }),
-        originalResult: result,
-    };
-}
-function toFormattedResult(adapter) {
-    const original = adapter.originalResult;
-    const filteredCloudConfigResults = original.result.cloudConfigResults.filter((res) => {
-        return adapter.vulnerabilities.some((vuln) => {
-            if (vuln.id !== res.id) {
-                return false;
-            }
-            // Unfortunately we are forced to duplicate the logic in
-            // toIaCVulnAdapter so that we're comparing path components properly,
-            // including target file context. As that logic changes, so must this.
-            const annotatedResult = res;
-            const significantPath = [...annotatedResult.cloudConfigPath];
-            significantPath.splice(0, 0, original.targetFile);
-            if (vuln.from.length !== significantPath.length) {
-                return false;
-            }
-            for (let i = 0; i < vuln.from.length; i++) {
-                if (vuln.from[i] !== significantPath[i]) {
-                    return false;
-                }
-            }
-            return true;
-        });
-    });
-    original.result.cloudConfigResults = filteredCloudConfigResults;
-    return original;
-}
-
-
-/***/ }),
-
-/***/ 47354:
-/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.FailedToFormatResults = exports.filterPoliciesBySeverity = exports.formatScanResults = void 0;
-const types_1 = __webpack_require__(94820);
-const common_1 = __webpack_require__(53110);
-const constants_1 = __webpack_require__(68620);
-const errors_1 = __webpack_require__(55191);
-const extract_line_number_1 = __webpack_require__(29576);
-const error_utils_1 = __webpack_require__(36401);
-const cloud_config_parser_1 = __webpack_require__(98611);
-const path = __webpack_require__(85622);
-const detect_1 = __webpack_require__(45318);
-const severitiesArray = common_1.SEVERITIES.map((s) => s.verboseName);
-function formatScanResults(scanResults, options, meta, projectPublicIds, gitRemoteUrl) {
-    try {
-        const groupedByFile = scanResults.reduce((memo, scanResult) => {
-            const res = formatScanResult(scanResult, meta, options);
-            if (memo[scanResult.filePath]) {
-                memo[scanResult.filePath].result.cloudConfigResults.push(...res.result.cloudConfigResults);
-            }
-            else {
-                res.meta.gitRemoteUrl = gitRemoteUrl;
-                res.meta.projectId = projectPublicIds[res.targetFile];
-                memo[scanResult.filePath] = res;
-            }
-            return memo;
-        }, {});
-        return Object.values(groupedByFile);
-    }
-    catch (e) {
-        throw new FailedToFormatResults();
-    }
-}
-exports.formatScanResults = formatScanResults;
-const engineTypeToProjectType = {
-    [types_1.EngineType.Kubernetes]: constants_1.IacProjectType.K8S,
-    [types_1.EngineType.Terraform]: constants_1.IacProjectType.TERRAFORM,
-    [types_1.EngineType.CloudFormation]: constants_1.IacProjectType.CLOUDFORMATION,
-    [types_1.EngineType.ARM]: constants_1.IacProjectType.ARM,
-    [types_1.EngineType.Custom]: constants_1.IacProjectType.CUSTOM,
-};
-function formatScanResult(scanResult, meta, options) {
-    const fileType = extract_line_number_1.getFileTypeForParser(scanResult.fileType);
-    const isGeneratedByCustomRule = scanResult.engineType === types_1.EngineType.Custom;
-    let treeByDocId;
-    try {
-        treeByDocId = cloud_config_parser_1.getTrees(fileType, scanResult.fileContent);
-    }
-    catch (err) {
-        // we do nothing intentionally.
-        // Even if the building of the tree fails in the external parser,
-        // we still pass an undefined tree and not calculated line number for those
-    }
-    const formattedIssues = scanResult.violatedPolicies.map((policy) => {
-        const cloudConfigPath = scanResult.docId !== undefined
-            ? [`[DocId: ${scanResult.docId}]`].concat(cloud_config_parser_1.parsePath(policy.msg))
-            : policy.msg.split('.');
-        const lineNumber = treeByDocId
-            ? extract_line_number_1.extractLineNumber(cloudConfigPath, fileType, treeByDocId)
-            : -1;
-        return {
-            ...policy,
-            id: policy.publicId,
-            name: policy.title,
-            cloudConfigPath,
-            isIgnored: false,
-            iacDescription: {
-                issue: policy.issue,
-                impact: policy.impact,
-                resolve: policy.resolve,
-            },
-            severity: policy.severity,
-            lineNumber,
-            documentation: !isGeneratedByCustomRule
-                ? `https://snyk.io/security-rules/${policy.publicId}`
-                : undefined,
-            isGeneratedByCustomRule,
-        };
-    });
-    const { targetFilePath, projectName, targetFile } = computePaths(scanResult.filePath, options.path);
-    return {
-        result: {
-            cloudConfigResults: filterPoliciesBySeverity(formattedIssues, options.severityThreshold),
-            projectType: scanResult.projectType,
-        },
-        meta: {
-            ...meta,
-            projectId: '',
-            policy: '',
-        },
-        filesystemPolicy: false,
-        vulnerabilities: [],
-        dependencyCount: 0,
-        licensesPolicy: null,
-        ignoreSettings: null,
-        targetFile,
-        projectName,
-        org: meta.org,
-        policy: '',
-        isPrivate: true,
-        targetFilePath,
-        packageManager: engineTypeToProjectType[scanResult.engineType],
-    };
-}
-function filterPoliciesBySeverity(violatedPolicies, severityThreshold) {
-    if (!severityThreshold || severityThreshold === common_1.SEVERITY.LOW) {
-        return violatedPolicies.filter((violatedPolicy) => {
-            return violatedPolicy.severity !== 'none';
-        });
-    }
-    const severitiesToInclude = severitiesArray.slice(severitiesArray.indexOf(severityThreshold));
-    return violatedPolicies.filter((policy) => {
-        return (policy.severity !== 'none' &&
-            severitiesToInclude.includes(policy.severity));
-    });
-}
-exports.filterPoliciesBySeverity = filterPoliciesBySeverity;
-class FailedToFormatResults extends errors_1.CustomError {
-    constructor(message) {
-        super(message || 'Failed to format results');
-        this.code = types_1.IaCErrorCodes.FailedToFormatResults;
-        this.strCode = error_utils_1.getErrorStringCode(this.code);
-        this.userMessage =
-            'We failed printing the results, please contact support@snyk.io';
-    }
-}
-exports.FailedToFormatResults = FailedToFormatResults;
-function computePaths(filePath, pathArg = '.') {
-    const targetFilePath = path.resolve(filePath, '.');
-    // the absolute path is needed to compute the full project path
-    const cmdPath = path.resolve(pathArg);
-    let projectPath;
-    let targetFile;
-    if (!detect_1.isLocalFolder(cmdPath)) {
-        // if the provided path points to a file, then the project starts at the parent folder of that file
-        // and the target file was provided as the path argument
-        projectPath = path.dirname(cmdPath);
-        targetFile = path.isAbsolute(pathArg)
-            ? path.relative(process.cwd(), pathArg)
-            : pathArg;
-    }
-    else {
-        // otherwise, the project starts at the provided path
-        // and the target file must be the relative path from the project path to the path of the scanned file
-        projectPath = cmdPath;
-        targetFile = path.relative(projectPath, targetFilePath);
-    }
-    return {
-        targetFilePath,
-        projectName: path.basename(projectPath),
-        targetFile,
-    };
-}
-
-
-/***/ }),
-
-/***/ 42564:
-/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.formatShareResults = void 0;
-const path = __webpack_require__(85622);
-const git_1 = __webpack_require__(82421);
-function formatShareResults(scanResults) {
-    const resultsGroupedByFilePath = groupByFilePath(scanResults);
-    return resultsGroupedByFilePath.map((result) => {
-        const { projectName, targetFile } = computePaths(result.filePath);
-        return {
-            projectName,
-            targetFile,
-            filePath: result.filePath,
-            fileType: result.fileType,
-            projectType: result.projectType,
-            violatedPolicies: result.violatedPolicies,
-        };
+function getResourceName(index, name) {
+    return index !== undefined ? `${name}["${index}"]` : name;
+}
+function resourceChangeReducer(scanInput, resource, isFullScan) {
+    // TODO: investigate if we need to address also `after_unknown` field.
+    const { actions, after } = resource.change || { actions: [], after: {} };
+    if (isValidResourceActions(actions, isFullScan)) {
+        const resourceForReduction = { ...resource, values: after || {} };
+        return terraformPlanReducer(scanInput, resourceForReduction);
+    }
+    return scanInput;
+}
+function isValidResourceActions(action, isFullScan) {
+    const VALID_ACTIONS = isFullScan
+        ? types_1.VALID_RESOURCE_ACTIONS_FOR_FULL_SCAN
+        : types_1.VALID_RESOURCE_ACTIONS_FOR_DELTA_SCAN;
+    return VALID_ACTIONS.some((validAction) => {
+        if (action.length !== validAction.length) {
+            return false;
+        }
+        return validAction.every((field, idx) => action[idx] === field);
     });
 }
-exports.formatShareResults = formatShareResults;
-function groupByFilePath(scanResults) {
-    const groupedByFilePath = scanResults.reduce((memo, scanResult) => {
-        scanResult.violatedPolicies.forEach((violatedPolicy) => {
-            violatedPolicy.docId = scanResult.docId;
-        });
-        if (memo[scanResult.filePath]) {
-            memo[scanResult.filePath].violatedPolicies.push(...scanResult.violatedPolicies);
+function referencedResourcesResolver(scanInput, resources) {
+    var _a, _b;
+    // check root module for references in first depth of attributes
+    for (const resource of resources) {
+        const { type, name, mode, index, expressions } = resource;
+        // don't care about references in data sources for time being
+        if (mode == 'data') {
+            continue;
         }
-        else {
-            memo[scanResult.filePath] = scanResult;
+        const inputKey = 'resource';
+        // only update the references in resources that have some resolved attributes already
+        const resolvedResource = (_b = (_a = scanInput[inputKey]) === null || _a === void 0 ? void 0 : _a[type]) === null || _b === void 0 ? void 0 : _b[getResourceName(index, name)];
+        if (resolvedResource && expressions) {
+            const resourceExpressions = getExpressions(expressions);
+            for (const key of Object.keys(resourceExpressions)) {
+                // only add non existing attributes. If we already have resolved value do not overwrite it with reference
+                if (!resolvedResource[key]) {
+                    resolvedResource[key] = resourceExpressions[key];
+                }
+            }
+            scanInput[inputKey][type][getResourceName(index, name)] = resolvedResource;
         }
-        return memo;
-    }, {});
-    return Object.values(groupedByFilePath);
+    }
+    return scanInput;
 }
-function computePaths(filePath) {
-    const currentDirectory = getGitRootOrCwd(path.resolve(filePath));
-    const currentDirectoryName = path.basename(currentDirectory);
-    const absoluteFilePath = path.resolve(filePath);
-    const relativeFilePath = path.relative(currentDirectory, absoluteFilePath);
-    const unixRelativeFilePath = relativeFilePath.split(path.sep).join('/');
-    return {
-        targetFilePath: absoluteFilePath,
-        projectName: currentDirectoryName,
-        targetFile: unixRelativeFilePath,
-    };
+function extractResourceChanges(terraformPlanJson) {
+    return terraformPlanJson.resource_changes || [];
+}
+function extractReferencedResources(terraformPlanJson) {
+    var _a, _b;
+    return ((_b = (_a = terraformPlanJson.configuration) === null || _a === void 0 ? void 0 : _a.root_module) === null || _b === void 0 ? void 0 : _b.resources) || [];
+}
+function extractResourcesForScan(terraformPlanJson, isFullScan = false) {
+    const resourceChanges = extractResourceChanges(terraformPlanJson);
+    const scanInput = resourceChanges.reduce((memo, curr) => resourceChangeReducer(memo, curr, isFullScan), {
+        resource: {},
+        data: {},
+    });
+    const referencedResources = extractReferencedResources(terraformPlanJson);
+    return referencedResourcesResolver(scanInput, referencedResources);
+}
+function isTerraformPlan(terraformPlanJson) {
+    const missingRequiredFields = terraformPlanJson.resource_changes === undefined;
+    return !missingRequiredFields;
 }
-function getGitRootOrCwd(currentPath) {
+exports.isTerraformPlan = isTerraformPlan;
+function tryParsingTerraformPlan(terraformPlanFile, terraformPlanJson, { isFullScan } = { isFullScan: false }) {
     try {
-        return git_1.getRepositoryRootForPath(currentPath);
+        return [
+            {
+                ...terraformPlanFile,
+                jsonContent: extractResourcesForScan(terraformPlanJson, isFullScan),
+                engineType: types_1.EngineType.Terraform,
+                projectType: constants_1.IacProjectType.TERRAFORM,
+            },
+        ];
     }
-    catch (e) {
-        return git_1.getWorkingDirectoryForPath(currentPath);
+    catch (err) {
+        throw new FailedToExtractResourcesInTerraformPlanError();
     }
 }
-
-
-/***/ }),
-
-/***/ 20588:
-/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.formatAndShareResults = void 0;
-const feature_flags_1 = __webpack_require__(63011);
-const cli_share_results_1 = __webpack_require__(24016);
-const assert_iac_options_flag_1 = __webpack_require__(33111);
-const share_results_formatter_1 = __webpack_require__(42564);
-async function formatAndShareResults({ results, options, orgPublicId, policy, tags, attributes, pathToScan, }) {
-    const isCliReportEnabled = await feature_flags_1.isFeatureFlagSupportedForOrg('iacCliShareResults', orgPublicId);
-    if (!isCliReportEnabled.ok) {
-        throw new assert_iac_options_flag_1.FeatureFlagError('report', 'iacCliShareResults');
+exports.tryParsingTerraformPlan = tryParsingTerraformPlan;
+// This error is due to the complex reduction logic, so it catches scenarios we might have not covered.
+class FailedToExtractResourcesInTerraformPlanError extends errors_1.CustomError {
+    constructor(message) {
+        super(message || 'Failed to extract resources from Terraform plan JSON file');
+        this.code = types_1.IaCErrorCodes.FailedToExtractResourcesInTerraformPlanError;
+        this.strCode = error_utils_1.getErrorStringCode(this.code);
+        this.userMessage =
+            'We failed to extract resource changes from the Terraform plan file, please contact support@snyk.io, if possible with a redacted version of the file';
     }
-    const formattedResults = share_results_formatter_1.formatShareResults(results);
-    return await cli_share_results_1.shareResults({
-        results: formattedResults,
-        policy,
-        tags,
-        attributes,
-        options,
-        pathToScan,
-    });
 }
-exports.formatAndShareResults = formatAndShareResults;
+exports.FailedToExtractResourcesInTerraformPlanError = FailedToExtractResourcesInTerraformPlanError;
 
 
 /***/ }),
 
-/***/ 13220:
+/***/ 40008:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
 "use strict";
@@ -1557,7 +1111,7 @@ async function readGitInfoForProjectRoot(projectRoot) {
 
 /***/ }),
 
-/***/ 98668:
+/***/ 30537:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
 "use strict";
@@ -1610,39 +1164,31 @@ class FailedToExtractLineNumberError extends errors_1.CustomError {
 
 /***/ }),
 
-/***/ 89324:
+/***/ 1229:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.processResults = void 0;
-const policy_1 = __webpack_require__(62472);
-const share_results_1 = __webpack_require__(64546);
-const measurable_methods_1 = __webpack_require__(5687);
-async function processResults(resultsWithCustomSeverities, orgPublicId, iacOrgSettings, policy, tags, attributes, options, projectRoot) {
-    let projectPublicIds = {};
-    let gitRemoteUrl;
-    if (options.report) {
-        ({ projectPublicIds, gitRemoteUrl } = await share_results_1.formatAndShareResults({
-            results: resultsWithCustomSeverities,
-            options,
-            orgPublicId,
-            policy,
-            tags,
-            attributes,
-            projectRoot,
-        }));
+exports.SingleGroupResultsProcessor = void 0;
+const process_results_1 = __webpack_require__(78744);
+class SingleGroupResultsProcessor {
+    constructor(projectRoot, orgPublicId, iacOrgSettings, options) {
+        this.projectRoot = projectRoot;
+        this.orgPublicId = orgPublicId;
+        this.iacOrgSettings = iacOrgSettings;
+        this.options = options;
+    }
+    processResults(resultsWithCustomSeverities, policy, tags, attributes) {
+        return process_results_1.processResults(resultsWithCustomSeverities, this.orgPublicId, this.iacOrgSettings, policy, tags, attributes, this.options, this.projectRoot);
     }
-    const formattedResults = measurable_methods_1.formatScanResultsV2(resultsWithCustomSeverities, options, iacOrgSettings.meta, projectPublicIds, projectRoot, gitRemoteUrl);
-    return policy_1.filterIgnoredIssues(policy, formattedResults);
 }
-exports.processResults = processResults;
+exports.SingleGroupResultsProcessor = SingleGroupResultsProcessor;
 
 
 /***/ }),
 
-/***/ 62472:
+/***/ 91434:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -1708,7 +1254,39 @@ function toFormattedResult(adapter) {
 
 /***/ }),
 
-/***/ 50350:
+/***/ 78744:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.processResults = void 0;
+const policy_1 = __webpack_require__(91434);
+const share_results_1 = __webpack_require__(68971);
+const measurable_methods_1 = __webpack_require__(5687);
+async function processResults(resultsWithCustomSeverities, orgPublicId, iacOrgSettings, policy, tags, attributes, options, projectRoot) {
+    let projectPublicIds = {};
+    let gitRemoteUrl;
+    if (options.report) {
+        ({ projectPublicIds, gitRemoteUrl } = await share_results_1.formatAndShareResults({
+            results: resultsWithCustomSeverities,
+            options,
+            orgPublicId,
+            policy,
+            tags,
+            attributes,
+            projectRoot,
+        }));
+    }
+    const formattedResults = measurable_methods_1.formatScanResultsV2(resultsWithCustomSeverities, options, iacOrgSettings.meta, projectPublicIds, projectRoot, gitRemoteUrl);
+    return policy_1.filterIgnoredIssues(policy, formattedResults);
+}
+exports.processResults = processResults;
+
+
+/***/ }),
+
+/***/ 11059:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
 "use strict";
@@ -1719,7 +1297,7 @@ const types_1 = __webpack_require__(94820);
 const common_1 = __webpack_require__(53110);
 const constants_1 = __webpack_require__(68620);
 const errors_1 = __webpack_require__(55191);
-const extract_line_number_1 = __webpack_require__(98668);
+const extract_line_number_1 = __webpack_require__(30537);
 const error_utils_1 = __webpack_require__(36401);
 const cloud_config_parser_1 = __webpack_require__(98611);
 const path = __webpack_require__(85622);
@@ -1869,7 +1447,7 @@ function computePaths(projectRoot, filePath, pathArg = '.') {
 
 /***/ }),
 
-/***/ 99430:
+/***/ 97153:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
 "use strict";
@@ -1923,7 +1501,7 @@ function computePaths(projectRoot, filePath) {
 
 /***/ }),
 
-/***/ 64546:
+/***/ 68971:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
 "use strict";
@@ -1931,9 +1509,9 @@ function computePaths(projectRoot, filePath) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.formatAndShareResults = void 0;
 const feature_flags_1 = __webpack_require__(63011);
-const cli_share_results_1 = __webpack_require__(13220);
+const cli_share_results_1 = __webpack_require__(40008);
 const assert_iac_options_flag_1 = __webpack_require__(33111);
-const share_results_formatter_1 = __webpack_require__(99430);
+const share_results_formatter_1 = __webpack_require__(97153);
 async function formatAndShareResults({ results, options, orgPublicId, policy, tags, attributes, projectRoot, }) {
     const isCliReportEnabled = await feature_flags_1.isFeatureFlagSupportedForOrg('iacCliShareResults', orgPublicId);
     if (!isCliReportEnabled.ok) {
@@ -2287,7 +1865,6 @@ const display_result_1 = __webpack_require__(89667);
 const assert_iac_options_flag_1 = __webpack_require__(33111);
 const ora = __webpack_require__(63395);
 const errors_1 = __webpack_require__(55191);
-const path = __webpack_require__(85622);
 const v2_1 = __webpack_require__(49041);
 const iac_output_2 = __webpack_require__(68145);
 const debug = Debug('snyk-test');
@@ -2298,12 +1875,9 @@ function buildSpinner({ options, isNewIacOutputSupported, }) {
     }
 }
 exports.buildSpinner = buildSpinner;
-function printHeader({ paths, options, isNewIacOutputSupported, }) {
+function printHeader({ options, isNewIacOutputSupported, }) {
     if (iac_output_1.shouldLogUserMessages(options, isNewIacOutputSupported)) {
         console.log(os_1.EOL + iac_output_1.iacTestTitle + os_1.EOL);
-        if (paths.some(isOutsideCurrentWorkingDirectory)) {
-            printCurrentWorkingDirectoryTraversalWarning();
-        }
     }
 }
 exports.printHeader = printHeader;
@@ -2481,23 +2055,6 @@ function buildOutput({ results, options, isNewIacOutputSupported, isIacShareCliR
     return types_1.TestCommandResult.createHumanReadableTestCommandResult(response, stringifiedJsonData, stringifiedSarifData);
 }
 exports.buildOutput = buildOutput;
-function isOutsideCurrentWorkingDirectory(p) {
-    return path.relative(process.cwd(), p).includes('..');
-}
-function printCurrentWorkingDirectoryTraversalWarning() {
-    let msg = '';
-    msg +=
-        'Warning: Scanning paths outside the current working directory is deprecated and' +
-            os_1.EOL;
-    msg +=
-        'will be removed in the future. Please see the documentation for further details:' +
-            os_1.EOL +
-            os_1.EOL;
-    msg +=
-        '  https://docs.snyk.io/products/snyk-infrastructure-as-code/snyk-cli-for-infrastructure-as-code/test-your-configuration-files' +
-            os_1.EOL;
-    console.log(chalk_1.default.yellow(msg));
-}
 function buildShareResultsSummary({ iacOutputMeta, options, isIacCustomRulesEntitlementEnabled, isNewIacOutputSupported, isIacShareCliResultsCustomRulesSupported, }) {
     let response = '';
     response += SEPARATOR + os_1.EOL + iac_output_1.formatShareResultsOutput(iacOutputMeta);
@@ -2559,16 +2116,10 @@ async function scan(iacOrgSettings, options, testSpinner, paths, orgPublicId, bu
             let res;
             try {
                 assert_iac_options_flag_1.assertIaCOptionsFlags(process.argv);
-                let resultsProcessor;
-                if (projectRoot) {
-                    if (pathLib.relative(projectRoot, path).includes('..')) {
-                        throw new CurrentWorkingDirectoryTraversalError();
-                    }
-                    resultsProcessor = new process_results_1.SingleGroupResultsProcessor(projectRoot, orgPublicId, iacOrgSettings, testOpts);
-                }
-                else {
-                    resultsProcessor = new process_results_1.MultipleGroupsResultsProcessor(path, orgPublicId, iacOrgSettings, testOpts);
+                if (pathLib.relative(projectRoot, path).includes('..')) {
+                    throw new CurrentWorkingDirectoryTraversalError(path);
                 }
+                const resultsProcessor = new process_results_1.SingleGroupResultsProcessor(projectRoot, orgPublicId, iacOrgSettings, testOpts);
                 const { results, failures, ignoreCount } = await local_execution_1.test(resultsProcessor, path, testOpts, iacOrgSettings, rulesOrigin);
                 iacOutputMeta = {
                     orgName: (_a = results[0]) === null || _a === void 0 ? void 0 : _a.org,
@@ -2639,11 +2190,12 @@ function formatTestError(error) {
     return errorResponse;
 }
 class CurrentWorkingDirectoryTraversalError extends errors_1.CustomError {
-    constructor() {
+    constructor(path) {
         super('Path is outside the current working directory');
         this.code = types_1.IaCErrorCodes.CurrentWorkingDirectoryTraversalError;
         this.strCode = error_utils_1.getErrorStringCode(this.code);
         this.userMessage = `Path is outside the current working directory`;
+        this.filename = path;
     }
 }
 
@@ -2673,7 +2225,6 @@ async function test(paths, options) {
         isNewIacOutputSupported: true,
     });
     output_1.printHeader({
-        paths,
         options,
         isNewIacOutputSupported: true,
     });
@@ -3670,73 +3221,6 @@ function metadataForVuln(vuln) {
 }
 
 
-/***/ }),
-
-/***/ 24016:
-/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.shareResults = void 0;
-const config_1 = __webpack_require__(25425);
-const request_1 = __webpack_require__(52050);
-const api_token_1 = __webpack_require__(95181);
-const envelope_formatters_1 = __webpack_require__(88784);
-const git_1 = __webpack_require__(24850);
-const analytics = __webpack_require__(82744);
-const dev_count_analysis_1 = __webpack_require__(73898);
-const Debug = __webpack_require__(15158);
-const errors_1 = __webpack_require__(55191);
-const debug = Debug('iac-cli-share-results');
-const usage_tracking_1 = __webpack_require__(70413);
-const git_2 = __webpack_require__(82421);
-async function shareResults({ results, policy, tags, attributes, options, pathToScan, }) {
-    var _a, _b;
-    const gitTarget = (await git_1.getInfo({
-        isFromContainer: false,
-        cwd: git_2.getWorkingDirectoryForPath(pathToScan),
-    }));
-    const scanResults = results.map((result) => envelope_formatters_1.convertIacResultToScanResult(result, policy, gitTarget, options));
-    let contributors = [];
-    if (gitTarget.remoteUrl) {
-        if (analytics.allowAnalytics()) {
-            try {
-                contributors = await dev_count_analysis_1.getContributors();
-            }
-            catch (err) {
-                debug('error getting repo contributors', err);
-            }
-        }
-    }
-    const { res, body } = await request_1.makeRequest({
-        method: 'POST',
-        url: `${config_1.default.API}/iac-cli-share-results`,
-        json: true,
-        qs: { org: (_a = options === null || options === void 0 ? void 0 : options.org) !== null && _a !== void 0 ? _a : config_1.default.org },
-        headers: {
-            authorization: api_token_1.getAuthHeader(),
-        },
-        body: {
-            scanResults,
-            contributors,
-            tags,
-            attributes,
-        },
-    });
-    switch (res.statusCode) {
-        case 401:
-            throw errors_1.AuthFailedError();
-        case 422:
-            throw new errors_1.ValidationError((_b = res.body.error) !== null && _b !== void 0 ? _b : 'An error occurred, please contact Snyk support');
-        case 429:
-            throw new usage_tracking_1.TestLimitReachedError();
-    }
-    return { projectPublicIds: body, gitRemoteUrl: gitTarget === null || gitTarget === void 0 ? void 0 : gitTarget.remoteUrl };
-}
-exports.shareResults = shareResults;
-
-
 /***/ }),
 
 /***/ 88784: