Merge pull request Checkmarx#7057 from Checkmarx/AST-40742

fix(query): implicit flow in oauth2 queries duplicated
liorj-orca · Jun 11, 2024 · e83ddfc · e83ddfc
2 parents f384835 + ddfa8be
commit e83ddfc
Show file tree

Hide file tree

Showing 14 changed files with 73 additions and 340 deletions.
diff --git a/assets/queries/openAPI/3.0/implicit_flow_oauth2/metadata.json b/assets/queries/openAPI/3.0/implicit_flow_oauth2/metadata.json
diff --git a/assets/queries/openAPI/3.0/implicit_flow_oauth2/query.rego b/assets/queries/openAPI/3.0/implicit_flow_oauth2/query.rego
diff --git a/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/negative1.json b/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/negative1.json
diff --git a/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/negative2.yaml b/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/negative2.yaml
diff --git a/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/positive1.json b/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/positive1.json
diff --git a/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/positive2.json b/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/positive2.json
diff --git a/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/positive3.json b/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/positive3.json
diff --git a/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/positive4.yaml b/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/positive4.yaml
diff --git a/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/positive_expected_result.json b/assets/queries/openAPI/3.0/implicit_flow_oauth2/test/positive_expected_result.json
diff --git a/assets/queries/openAPI/3.0/oauth2_with_implicit_flow/query.rego b/assets/queries/openAPI/3.0/oauth2_with_implicit_flow/query.rego
@@ -1,21 +1,21 @@
 package Cx
 
 import data.generic.openapi as openapi_lib
+import data.generic.common as common_lib
 
 CxPolicy[result] {
 	doc := input.document[i]
 	openapi_lib.check_openapi(doc) == "3.0"
 
-	security_scheme := doc.components.securitySchemes[name]
+	security_scheme := doc.components.securitySchemes[key]
 	security_scheme.type == "oauth2"
-	flow := security_scheme.flows[flow_object]
-	flow_object == "implicit"
+	common_lib.valid_key(security_scheme.flows, "implicit")
 
 	result := {
 		"documentId": doc.id,
-		"searchKey": sprintf("components.securitySchemes.{{%s}}.flows.implicit", [name]),
+		"searchKey": sprintf("components.securitySchemes.{{%s}}.flows.implicit", [key]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("components.securitySchemes.{{%s}}.flows do not contain an 'implicit' flow", [name]),
-		"keyActualValue": sprintf("components.securitySchemes.{{%s}}.flows contain an 'implicit' flow", [name]),
+		"keyExpectedValue": sprintf("components.securitySchemes.{{%s}}.flows should not use 'implicit' flow", [key]),
+		"keyActualValue": sprintf("components.securitySchemes.{{%s}}.flows is using 'implicit' flow", [key]),
 	}
 }