Merge pull request #7035 from Checkmarx/AST-40687

fix(query): slight refactor to actually filter the correct/wanted codes

assets/queries/openAPI/general/response_operations_body_schema_undefined/query.rego

@@ -9,9 +9,9 @@ CxPolicy[result] {
 	version != "undefined"
 
 	operation := doc.paths[p][op]
-	acceptable_response(operation, op)
-
 	response := operation.responses[code]
+	acceptable_response(code, op)
+
 	key := get_key_by_version(version)
 	not common_lib.valid_key(response, key)
 
@@ -31,9 +31,10 @@ CxPolicy[result] {
 	version == "3.0"
 
 	operation := doc.paths[path][op]
-	acceptable_response(operation, op)
+	response := operation.responses[code]
+	acceptable_response(code, op)
 
-	count(operation.responses[code].content) == 0
+	count(response.content) == 0
 
 	result := {
 		"documentId": doc.id,
@@ -50,9 +51,9 @@ CxPolicy[result] {
 	version == "3.0"
 
 	operation := doc.paths[path][op]
-	acceptable_response(operation, op)
-
 	response := operation.responses[code]
+	acceptable_response(code, op)
+
 	responses := response.content[content_type]
 	not common_lib.valid_key(responses, "schema")
 
@@ -65,13 +66,12 @@ CxPolicy[result] {
 	}
 }
 
-acceptable_response(operation, op) {
+acceptable_response(code, op) {
 	operation_should_have_content := ["get", "put", "post", "delete", "options", "patch", "trace"]
 	common_lib.equalsOrInArray(operation_should_have_content, lower(op))
 
 	response_code_should_not_have_content := ["204", "304"]
 
-	response := operation.responses[code]
 	not common_lib.equalsOrInArray(response_code_should_not_have_content, lower(code))
 }
 

assets/queries/openAPI/general/response_operations_body_schema_undefined/test/negative5.json

@@ -0,0 +1,115 @@
+{
+  "openapi": "3.0.1",
+  "info": {
+    "title": "Test",
+    "description": "test",
+    "version": "1.0"
+  },
+  "servers": [
+    {
+      "url": "https://example.com",
+      "description": "Example"
+    }
+  ],
+  "paths": {
+    "/Header/{SourceID}": {
+      "get": {
+        "summary": "Forecast Header Updates",
+        "description": "Get Forecast Header channel data from MDM for a given source.",
+        "operationId": "GetForecastHeader",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "",
+            "headers": {
+              "x-test-forecasts-ack-id": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ForecastHeaders"
+                }
+              },
+              "text/plain": {
+                "schema": {
+                  "$ref": "#/components/schemas/ForecastHeaders"
+                },
+                "examples": {
+                  "default": {
+                    "value": null
+                  }
+                }
+              }
+            }
+          },
+          "204": {
+            "description": "There are no more updates available."
+          }
+        }
+      }
+    },
+    "/Detail/{SourceID}": {
+      "get": {
+        "summary": "Forecast Detail Updates",
+        "description": "Get Forecast Header channel data from MDM for a given source.",
+        "operationId": "GetForecastDetail",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "",
+            "headers": {
+              "x-test-forecastdetails-ack-id": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ForecastDetails"
+                }
+              },
+              "text/plain": {
+                "schema": {
+                  "$ref": "#/components/schemas/ForecastDetails"
+                },
+                "examples": {
+                  "default": {
+                    "value": null
+                  }
+                }
+              }
+            }
+          },
+          "204": {
+            "description": "There are no more updates available."
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "schemas": {
+    },
+    "securitySchemes": {
+      "apiKeyHeader": {
+        "type": "apiKey",
+        "name": "Ocp-Apim-Subscription-Key",
+        "in": "header"
+      }
+    }
+  },
+  "security": [
+    {
+      "apiKeyHeader": []
+    },
+    {
+      "apiKeyQuery": []
+    }
+  ]
+}