checkov 3.2.332__py3-none-any.whl → 3.2.334__py3-none-any.whl

checkov/serverless/graph_builder/definition_context.py

@@ -0,0 +1,14 @@
+from __future__ import annotations
+
+from typing import Any
+
+
+def build_definitions_context(definitions: dict[str, dict[str, Any]], definitions_raw: dict[str, list[tuple[int, str]]]
+                              ) -> dict[str, dict[str, Any]]:
+    return {}
+
+
+def add_resource_to_definitions_context(definitions_context: dict[str, dict[str, Any]], resource_key: str,
+                                        resource_attributes: dict[str, Any], definition_attribute: str,
+                                        definitions_raw: dict[str, Any], file_path: str) -> None:
+    pass

checkov/serverless/graph_builder/graph_to_definitions.py

@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Any, TYPE_CHECKING
+
+from checkov.serverless.utils import ServerlessElements
+
+if TYPE_CHECKING:
+    from checkov.serverless.graph_builder.graph_components.blocks import ServerlessBlock
+
+
+def convert_graph_vertices_to_definitions(vertices: list[ServerlessBlock], root_folder: str | Path | None) \
+        -> tuple[dict[str, dict[str, Any]], dict[str, dict[str, Any]]]:
+    serverless_definitions: dict[str, dict[str, Any]] = {}
+    breadcrumbs: dict[str, dict[str, Any]] = {}
+    for vertex in vertices:
+        block_path = vertex.path
+        element_name = vertex.name.split('.')[-1]
+        # Plugins section is formatted as a list
+        if vertex.block_type == ServerlessElements.PLUGINS:
+            serverless_definitions.setdefault(block_path, {}).setdefault(vertex.block_type, []).append(element_name)
+
+        # If there is a ket named 'value' in the config it means that
+        # this vertex's config contains only a single string
+        elif 'value' in vertex.config:
+            # If the vertex is provider or service and it only contains a string the section should look like:
+            # provider: <value>
+            # service: <value>
+            if element_name == ServerlessElements.PROVIDER or element_name == ServerlessElements.SERVICE:
+                serverless_definitions.setdefault(block_path, {})[vertex.block_type] = vertex.config['value']
+
+            # Otherwise it's a vertex of a specific nested attribute and need to include the full path
+            # Examples:
+            # provider:
+            #   runtime: nodejs20.x
+            # custom:
+            #   myCustomVar: value
+            else:
+                serverless_definitions.setdefault(block_path, {}).setdefault(vertex.block_type, {})[element_name] = \
+                    vertex.config['value']
+
+        # Otherwise, the vertex config is a dict
+        else:
+            serverless_definitions.setdefault(block_path, {}).setdefault(vertex.block_type, {})[
+                element_name] = vertex.config
+
+        if vertex.breadcrumbs:
+            relative_block_path = f"/{os.path.relpath(block_path, root_folder)}"
+            add_breadcrumbs(vertex, breadcrumbs, relative_block_path)
+    return serverless_definitions, breadcrumbs
+
+
+def add_breadcrumbs(vertex: ServerlessBlock, breadcrumbs: dict[str, dict[str, Any]], relative_block_path: str) -> None:
+    breadcrumbs.setdefault(relative_block_path, {})[vertex.name] = vertex.breadcrumbs

checkov/serverless/graph_builder/local_graph.py

@@ -2,8 +2,12 @@ from __future__ import annotations
 
 from typing import Any
 
+from checkov.common.graph.graph_builder import CustomAttributes
 from checkov.common.graph.graph_builder.local_graph import LocalGraph, _Block
+from checkov.common.util.consts import LINE_FIELD_NAMES
+from checkov.common.util.data_structures_utils import pickle_deepcopy
 from checkov.serverless.graph_builder.graph_components.blocks import ServerlessBlock
+from checkov.serverless.utils import ServerlessElements
 
 
 class ServerlessLocalGraph(LocalGraph[ServerlessBlock]):
@@ -11,8 +15,86 @@ class ServerlessLocalGraph(LocalGraph[ServerlessBlock]):
         super().__init__()
         self.vertices: list[ServerlessBlock] = []
         self.definitions = definitions
-        self.vertices_by_path_and_id: dict[tuple[str, str], int] = {}
-        self.vertices_by_name: dict[str, int] = {}
+        self.vertices_by_path_and_name: dict[tuple[str, str], int] = {}
+
+    def build_graph(self, render_variables: bool = True) -> None:
+        self._create_vertices()
+
+    def _create_vertices(self) -> None:
+        for file_path, definition in self.definitions.items():
+            self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.FUNCTIONS)
+            self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.PARAMS)
+            self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.PROVIDER)
+            self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.LAYERS)
+            self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.CUSTOM)
+            self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.PACKAGE)
+            self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.PLUGINS)
+            self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.SERVICE)
+            self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.RESOURCES)
+
+        for i, vertex in enumerate(self.vertices):
+            self.vertices_by_block_type[vertex.block_type].append(i)
+            self.vertices_by_path_and_name[(vertex.path, vertex.name)] = i
+
+            self.in_edges[i] = []
+            self.out_edges[i] = []
+
+    def _create_vertex(self, file_path: str, definition: dict[str, Any] | None,
+                       element_type: ServerlessElements) -> None:
+        if not definition:
+            return
+        resources = definition.get(element_type)
+        if not resources:
+            return
+
+        elif isinstance(resources, str):
+            self.vertices.append(ServerlessBlock(
+                name=f'{element_type}',
+                config={"value": pickle_deepcopy(resources)},
+                path=file_path,
+                block_type=element_type,
+                attributes={"value": pickle_deepcopy(resources)},
+                id=f"{file_path}:{element_type}"
+            ))
+
+        else:
+            for attribute in resources:
+                if attribute in LINE_FIELD_NAMES:
+                    continue
+
+                if isinstance(resources, list):
+                    full_conf = {"value": pickle_deepcopy(attribute)}
+                    self.vertices.append(ServerlessBlock(
+                        name=f'{element_type}.{attribute}',
+                        config=full_conf,
+                        path=file_path,
+                        block_type=element_type,
+                        attributes=full_conf,
+                        id=f"{file_path}:{element_type}.{attribute}"
+                    ))
+
+                else:
+                    attribute_value = resources[attribute]
+                    if not isinstance(attribute_value, dict):
+                        full_conf = {"value": pickle_deepcopy(attribute_value)}
+                    else:
+                        full_conf = attribute_value
+
+                    config = pickle_deepcopy(full_conf)
+
+                    resource_type = element_type
+
+                    attributes = pickle_deepcopy(config)
+                    attributes[CustomAttributes.RESOURCE_TYPE] = resource_type
+
+                    self.vertices.append(ServerlessBlock(
+                        name=f'{resource_type}.{attribute}',
+                        config=config,
+                        path=file_path,
+                        block_type=resource_type,
+                        attributes=attributes,
+                        id=f"{file_path}:{resource_type}.{attribute}"
+                    ))
 
     def get_resources_types_in_graph(self) -> list[str]:
         # not used
@@ -25,6 +107,3 @@ class ServerlessLocalGraph(LocalGraph[ServerlessBlock]):
 
     def update_vertices_configs(self) -> None:
         pass
-
-    def build_graph(self, render_variables: bool) -> None:
-        pass

checkov/serverless/runner.py

@@ -11,6 +11,8 @@ from checkov.cloudformation.context_parser import ContextParser as CfnContextPar
 from checkov.common.bridgecrew.check_type import CheckType
 from checkov.common.util.secrets import omit_secret_value_from_checks
 from checkov.serverless.base_registry import EntityDetails
+from checkov.serverless.graph_builder.definition_context import build_definitions_context
+from checkov.serverless.graph_builder.graph_to_definitions import convert_graph_vertices_to_definitions
 from checkov.serverless.graph_builder.local_graph import ServerlessLocalGraph
 from checkov.serverless.graph_manager import ServerlessGraphManager
 from checkov.serverless.parsers.context_parser import ContextParser as SlsContextParser, ContextParser
@@ -111,6 +113,17 @@ class Runner(BaseRunner[_ServerlessDefinitions, _ServerlessContext, ServerlessGr
             # Filter out empty files that have not been parsed successfully
             self.definitions = {k: v for k, v in definitions.items() if v}
             self.definitions_raw = {k: v for k, v in definitions_raw.items() if k in definitions.keys()}
+            self.context = build_definitions_context(definitions=self.definitions, definitions_raw=self.definitions_raw)
+
+            logging.info("Creating Serverless graph")
+            local_graph = self.graph_manager.build_graph_from_definitions(definitions=self.definitions)
+            logging.info("Successfully created Serverless graph")
+
+            self.graph_manager.save_graph(local_graph)
+            self.definitions, self.breadcrumbs = convert_graph_vertices_to_definitions(
+                vertices=local_graph.vertices,
+                root_folder=root_folder,
+            )
 
         self.pbar.initiate(len(self.definitions))
 
@@ -140,34 +153,34 @@ class Runner(BaseRunner[_ServerlessDefinitions, _ServerlessContext, ServerlessGr
         # "Complete" checks
         # NOTE: Ignore code content, no point in showing (could be long)
         file_abs_path = Path(sls_file).absolute()
-        entity_lines_range, entity_code_lines = sls_context_parser.extract_code_lines(sls_file_data)
-        if entity_lines_range:
-            skipped_checks = CfnContextParser.collect_skip_comments(entity_code_lines or [])
-            variable_evaluations: dict[str, Any] = {}
-            entity = EntityDetails(sls_context_parser.provider_type, sls_file_data)
-            results = complete_registry.scan(sls_file, entity, skipped_checks, runner_filter)
-            tags = cfn_utils.get_resource_tags(entity, complete_registry)  # type:ignore[arg-type]
-            if results:
-                for check, check_result in results.items():
-                    record = Record(check_id=check.id, check_name=check.name, check_result=check_result,
-                                    code_block=[],  # Don't show, could be large
-                                    file_path=self.extract_file_path_from_abs_path(Path(sls_file)),
-                                    file_line_range=entity_lines_range,
-                                    resource="complete",  # Weird, not sure what to put where
-                                    evaluations=variable_evaluations,
-                                    check_class=check.__class__.__module__,
-                                    file_abs_path=str(file_abs_path),
-                                    entity_tags=tags, severity=check.severity)
-                    record.set_guideline(check.guideline)
-                    report.add_record(record=record)
-            else:
-                report.extra_resources.add(
-                    ExtraResource(
-                        file_abs_path=str(file_abs_path),
-                        file_path=self.extract_file_path_from_abs_path(Path(sls_file)),
-                        resource="complete",
-                    )
+        entity_code_lines = self.definitions_raw[sls_file]
+        entity_lines_range = [1, len(entity_code_lines) - 1]
+        skipped_checks = CfnContextParser.collect_skip_comments(entity_code_lines or [])
+        variable_evaluations: dict[str, Any] = {}
+        entity = EntityDetails(sls_context_parser.provider_type, sls_file_data)
+        results = complete_registry.scan(sls_file, entity, skipped_checks, runner_filter)
+        tags = cfn_utils.get_resource_tags(entity, complete_registry)  # type:ignore[arg-type]
+        if results:
+            for check, check_result in results.items():
+                record = Record(check_id=check.id, check_name=check.name, check_result=check_result,
+                                code_block=[],  # Don't show, could be large
+                                file_path=self.extract_file_path_from_abs_path(Path(sls_file)),
+                                file_line_range=entity_lines_range,
+                                resource="complete",  # Weird, not sure what to put where
+                                evaluations=variable_evaluations,
+                                check_class=check.__class__.__module__,
+                                file_abs_path=str(file_abs_path),
+                                entity_tags=tags, severity=check.severity)
+                record.set_guideline(check.guideline)
+                report.add_record(record=record)
+        else:
+            report.extra_resources.add(
+                ExtraResource(
+                    file_abs_path=str(file_abs_path),
+                    file_path=self.extract_file_path_from_abs_path(Path(sls_file)),
+                    resource="complete",
                 )
+            )
 
     def single_item_sections_checks(self,
                                     sls_file: str,
@@ -183,7 +196,8 @@ class Runner(BaseRunner[_ServerlessDefinitions, _ServerlessContext, ServerlessGr
                 continue
             entity_lines_range, entity_code_lines = sls_context_parser.extract_code_lines(item_content)
             if not entity_lines_range:
-                entity_lines_range, entity_code_lines = sls_context_parser.extract_code_lines(sls_file_data)
+                entity_code_lines = self.definitions_raw[sls_file]
+                entity_lines_range = [1, len(entity_code_lines) - 1]
 
             skipped_checks = CfnContextParser.collect_skip_comments(entity_code_lines or [])
             variable_evaluations: dict[str, Any] = {}

checkov/serverless/utils.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import os
+from enum import Enum
 from typing import Callable, Any
 
 from checkov.common.parallelizer.parallel_runner import parallel_runner
@@ -11,6 +12,22 @@ SLS_FILE_MASK = os.getenv(
     "CKV_SLS_FILE_MASK", "serverless.yml,serverless.yaml").split(",")
 
 
+class ServerlessElements(str, Enum):
+    PARAMS = "params"
+    FUNCTIONS = "functions"
+    PROVIDER = "provider"
+    LAYERS = "layers"
+    CUSTOM = "custom"
+    PACKAGE = "package"
+    PLUGINS = "plugins"
+    SERVICE = "service"
+    RESOURCES = "resources"
+
+    def __str__(self) -> str:
+        # needed, because of a Python 3.11 change
+        return self.value
+
+
 def get_scannable_file_paths(root_folder: str | None = None, excluded_paths: list[str] | None = None) -> list[str]:
     files_list: list[str] = []
 

checkov/version.py

@@ -1 +1 @@
-version = '3.2.332'
+version = '3.2.334'

{checkov-3.2.332.dist-info → checkov-3.2.334.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: checkov
-Version: 3.2.332
+Version: 3.2.334
 Summary: Infrastructure as code static analysis
 Home-page: https://github.com/bridgecrewio/checkov
 Author: bridgecrew

{checkov-3.2.332.dist-info → checkov-3.2.334.dist-info}/RECORD

@@ -9,7 +9,7 @@ checkov/logging_init.py,sha256=ImCCNBBSanaHEAKBNG_e1Qp3BI6Ez0BPTkbSsyDmxTU,1135
 checkov/main.py,sha256=YD0umx-YHhXnTd8peTimMfXqe1SRfTw0h6m-3EsdefI,47873
 checkov/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 checkov/runner_filter.py,sha256=GdzBc-ija2h-pkeAdX9NyvlW6IqcZ0JjvwYyPWZXIAM,21580
-checkov/version.py,sha256=i6pyJXrLP-mVqlJ5_a3qbRpPaRbKYbJSsor9LMqi5RY,20
+checkov/version.py,sha256=83mWM7TS6nNpKOXWxc8eDyWuw4PRP0xghKRouDmsfd0,20
 checkov/ansible/__init__.py,sha256=hFBtNkREui5Ra8CnhV3kJX7AUSeZM0w9h7ClX3ZxSgo,45
 checkov/ansible/runner.py,sha256=Gf0J4K8jyR8-LkxOz7voPaRky-IWfWXyVbK-9CCFgh0,5578
 checkov/ansible/utils.py,sha256=VFD9x3_BgktbXJan1u_H1u1hFmxDEVXgNKXYJvIdP9s,7956
@@ -1400,8 +1400,8 @@ checkov/serverless/__init__.py,sha256=oUAn9dkSV07GfCKLSaqQANNJZwJn9j7kaVwDEBzAZr
 checkov/serverless/base_registry.py,sha256=X2mQAYcIiQscc1eazhtz2EWhdjQRi7Ep_kvFVhTfhm4,1970
 checkov/serverless/graph_manager.py,sha256=TNvJ5lGJMwoqluzzT9-zbmdNm2bN96_BrPiCOHPYCbk,1750
 checkov/serverless/registry.py,sha256=_Oh_DKa4lITlZnGlUJXR8WL2QM9R0-yp-zJNx4lKaLo,158
-checkov/serverless/runner.py,sha256=Fa4l3ii02XxkTO1dewNwd4C0KmpwOC-_DmwEj0T0vHc,19224
-checkov/serverless/utils.py,sha256=JyvBtSq_zpSv3v4DLfFsm4W_qUEGQzTMrPxuo3j1n38,1844
+checkov/serverless/runner.py,sha256=7LptCB2lYbwofmlHSPwB1ZDE6_QFeJLHdRJttXUKBvM,19921
+checkov/serverless/utils.py,sha256=jjMnYACz268bt0nRjv8eT-_lcRPBWulmo7g6BT12K4w,2232
 checkov/serverless/checks/__init__.py,sha256=tNuTOyQi1FcIiShwaMn2YYRApnAnPGrg42Tzt2DSTBg,391
 checkov/serverless/checks/base_function_check.py,sha256=Yrati_68MgPRgzL5nug6B5NNV0dfwlva4cGQOOcwMao,269
 checkov/serverless/checks/complete/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -1433,9 +1433,10 @@ checkov/serverless/checks/service/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeR
 checkov/serverless/checks/service/base_service_check.py,sha256=lMs4ZPaBFo2OMYfdd8o7zGY61P52BdP79V0OgtPN-fE,1143
 checkov/serverless/checks/service/registry.py,sha256=KQuotQAjNFc-iNVvmDxf6NIsKJPeILIkbQAcwwDJK44,105
 checkov/serverless/graph_builder/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-checkov/serverless/graph_builder/local_graph.py,sha256=i6RQHhHAgBMsIUnrsGK2Q2fvXuV9Vox_4IPDJNJc91I,1017
+checkov/serverless/graph_builder/definition_context.py,sha256=P1eqPcq8v8hZ-jvd_BaKdvENfGREnEPTIT0Qv4XRuMw,577
+checkov/serverless/graph_builder/graph_to_definitions.py,sha256=vifgIIv3YXHQeTYwnIxjktFjLt-QdwnZPd70kIB93y8,2531
+checkov/serverless/graph_builder/local_graph.py,sha256=pfMESZfkBq-Tfk3MOiL04MsBqKV429Cyq6XchdzDp1k,4924
 checkov/serverless/graph_builder/graph_components/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-checkov/serverless/graph_builder/graph_components/block_types.py,sha256=8i6MybOM4GGdLipw1URMPnYsFTBLvCBzfdkviaF1D_0,347
 checkov/serverless/graph_builder/graph_components/blocks.py,sha256=82o4ChXHL3yCJsywKDxb49PJQhFm-Aa8_YgyOy5mZ4E,532
 checkov/serverless/parsers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 checkov/serverless/parsers/context_parser.py,sha256=Xd9mQhQJ_mVi3srSxK_9Zudlc4KNTErMJZ5SJ32kgZ8,3586
@@ -2713,12 +2714,12 @@ checkov/yaml_doc/base_yaml_check.py,sha256=LbrPcztyZnm08sdj_l5KtgjqBNqlL580qFLc1
 checkov/yaml_doc/enums.py,sha256=U2IcWt-cFWu1tomKiXdNrRmgK3OwAZSkhOClNDyeY0A,158
 checkov/yaml_doc/registry.py,sha256=qpNeWr7CC63SWaT-_6qgx1pDJB3WSgsnSLwC6g7k34E,148
 checkov/yaml_doc/runner.py,sha256=wqKfpQwMp5SHaAA1vhPWysE_x_4ovHhFZZWuUd5xufo,5552
-checkov-3.2.332.data/scripts/checkov,sha256=5DHGDk_bkcuYsKKhH0gx2PAwSYKgGyufRFnsgwFLdHU,231
-checkov-3.2.332.data/scripts/checkov.cmd,sha256=jkySNCkwm1dkSBC8eCfrIz67ydiTKth3wls9vQMR0kk,957
+checkov-3.2.334.data/scripts/checkov,sha256=5DHGDk_bkcuYsKKhH0gx2PAwSYKgGyufRFnsgwFLdHU,231
+checkov-3.2.334.data/scripts/checkov.cmd,sha256=jkySNCkwm1dkSBC8eCfrIz67ydiTKth3wls9vQMR0kk,957
 sast_integration_tests/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 sast_integration_tests/test_checkov_sast_report.py,sha256=JiJeK28cwB5nWZbT1P9vWVhy60e1EDIrK_aSZrwaRMg,2361
-checkov-3.2.332.dist-info/LICENSE,sha256=6kUITFZ5KOxBFt9xcr66N0u_Z7yWwGo4Fx-vy0mjdRA,11348
-checkov-3.2.332.dist-info/METADATA,sha256=vGoP_6WsPEHl8yO4PXqYUEFuj6Yab-cSXpue3hSzTNU,26087
-checkov-3.2.332.dist-info/WHEEL,sha256=P9jw-gEje8ByB7_hXoICnHtVCrEwMQh-630tKvQWehc,91
-checkov-3.2.332.dist-info/top_level.txt,sha256=8TtaYYl8EDyycGLDTcoOJvih-3aoa9L4XZDUCrtnMwk,53
-checkov-3.2.332.dist-info/RECORD,,
+checkov-3.2.334.dist-info/LICENSE,sha256=6kUITFZ5KOxBFt9xcr66N0u_Z7yWwGo4Fx-vy0mjdRA,11348
+checkov-3.2.334.dist-info/METADATA,sha256=zic-GO0BwK5Zcby7EPxHeuRg--1iNM5vGCltK0JzaL8,26087
+checkov-3.2.334.dist-info/WHEEL,sha256=P9jw-gEje8ByB7_hXoICnHtVCrEwMQh-630tKvQWehc,91
+checkov-3.2.334.dist-info/top_level.txt,sha256=8TtaYYl8EDyycGLDTcoOJvih-3aoa9L4XZDUCrtnMwk,53
+checkov-3.2.334.dist-info/RECORD,,

checkov/serverless/graph_builder/graph_components/block_types.py

@@ -1,12 +0,0 @@
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Literal
-
-from checkov.common.graph.graph_builder.graph_components.block_types import BlockType as CommonBlockType
-
-
-@dataclass
-class BlockType(CommonBlockType):
-    PROVIDER: Literal["provider"] = "provider"
-    FUNCTIONS: Literal["functions"] = "functions"