fix(query): "name is not snake case" should check only resource names (…

…Checkmarx#4346)

Signed-off-by: Rogério Peixoto <[email protected]>

assets/queries/terraform/general/name_is_not_snake_case/query.rego

@@ -1,18 +1,35 @@
 package Cx
 
+import data.generic.common as common_lib
+
+CxPolicy[result] {
+	doc := input.document[i]
+	res_type := doc.resource[type]
+	res_type[name]
+	not is_snake_case(name)
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("resource.%s.%s", [type, name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": "All names should be on snake case pattern",
+		"keyActualValue": sprintf("'%s' is not in snake case", [name]),
+		"searchLine": common_lib.build_search_line(["resources", type, name], []),
+	}
+}
+
 CxPolicy[result] {
 	doc := input.document[i]
-	[path, value] := walk(doc)
-	not is_object(value)
-	not is_snake_case(path[idx])
-	wrongPath := array.slice(path, 0, idx + 1)
+	module := doc.module[name]
+	not is_snake_case(name)
 
 	result := {
 		"documentId": input.document[i].id,
-		"searchKey": sprintf("%s", [concat(".", wrongPath)]),
+		"searchKey": sprintf("module.%s", [name]),
 		"issueType": "IncorrectValue",
 		"keyExpectedValue": "All names should be on snake case pattern",
-		"keyActualValue": sprintf("'%s' is not in snake case", [path[idx]]),
+		"keyActualValue": sprintf("'%s' is not in snake case", [name]),
+		"searchLine": common_lib.build_search_line(["module", name], []),
 	}
 }
 

assets/queries/terraform/general/name_is_not_snake_case/test/positive1.tf

@@ -4,6 +4,13 @@ variable "cluster_name" {
   type        = string
 }
 
+resource "aws_eks_cluster" "positiveExample" {
+  depends_on                = [aws_cloudwatch_log_group.example]
+
+  enabled_cluster_log_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"]
+  name                      = var.cluster_name
+}
+
 module "acm" {
   source      = "git::https://example.com/vpc.git?ref=v1.2.0"
   version     = "~> v2.0"
@@ -15,10 +22,3 @@ module "acm" {
     aws = "aws.us_east_1" # cloudfront needs acm certificate to be from "us-east-1" region
   }
 }
-
-resource "aws_eks_cluster" "positiveExample" {
-  depends_on                = [aws_cloudwatch_log_group.example]
-
-  enabled_cluster_log_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"]
-  name                      = var.cluster_name
-}

assets/queries/terraform/general/name_is_not_snake_case/test/positive2.tf

@@ -0,0 +1,24 @@
+variable "cluster_name" {
+  default     = "example"
+  description = "cluster name"
+  type        = string
+}
+
+resource "aws_eks_cluster" "positive2" {
+  depends_on                = [aws_cloudwatch_log_group.example]
+
+  enabled_cluster_log_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"]
+  name                      = var.cluster_name
+}
+
+module "ACMPositive2" {
+  source      = "git::https://example.com/vpc.git?ref=v1.2.0"
+  version     = "~> v2.0"
+  domain_name = var.site_domain
+  zone_id     = data.aws_route53_zone.this.zone_id
+  tags        = var.tags
+
+  providers = {
+    aws = "aws.us_east_1" # cloudfront needs acm certificate to be from "us-east-1" region
+  }
+}

assets/queries/terraform/general/name_is_not_snake_case/test/positive_expected_result.json

@@ -2,7 +2,13 @@
   {
     "queryName": "Name Is Not Snake Case",
     "severity": "INFO",
-    "line": 19,
+    "line": 7,
     "filename": "positive1.tf"
+  },
+  {
+    "queryName": "Name Is Not Snake Case",
+    "severity": "INFO",
+    "line": 14,
+    "filename": "positive2.tf"
   }
 ]