Skip to content

Commit ed55460

Browse files
cx-dmitri-rivincx-dmitri-rivin
committed
Revert "Remove file existence checks from validation - let container resolver handle it"
This reverts commit 35f747e.
1 parent 35f747e commit ed55460

File tree

2 files changed

+61
-44
lines changed

2 files changed

+61
-44
lines changed

‎internal/commands/scan.go‎

Lines changed: 41 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ import (
3030
exitCodes "github.com/checkmarx/ast-cli/internal/constants/exit-codes"
3131
"github.com/checkmarx/ast-cli/internal/logger"
3232
"github.com/checkmarx/ast-cli/internal/services"
33+
"github.com/checkmarx/ast-cli/internal/services/osinstaller"
3334
"github.com/google/uuid"
3435
"github.com/pkg/errors"
3536

@@ -3658,8 +3659,14 @@ func validateContainerImageFormat(containerImage string) error {
36583659
// Step 3: No colon found - check if it's a tar file or special prefix that doesn't require tags
36593660
lowerInput := strings.ToLower(sanitizedInput)
36603661
if strings.HasSuffix(lowerInput, ".tar") {
3661-
// It's a tar file - validation passed
3662-
// Note: We don't check file existence here for the same reasons as in validateFilePath
3662+
// It's a tar file - check if it exists locally
3663+
exists, err := osinstaller.FileExists(sanitizedInput)
3664+
if err != nil {
3665+
return errors.Errorf("--container-images flag error: %v", err)
3666+
}
3667+
if !exists {
3668+
return errors.Errorf("--container-images flag error: file '%s' does not exist", sanitizedInput)
3669+
}
36633670
return nil // Valid tar file
36643671
}
36653672

@@ -3737,10 +3744,13 @@ func validateFilePath(filePath string) error {
37373744
return errors.Errorf("--container-images flag error: file '%s' is not a valid tar file. Expected .tar extension", filePath)
37383745
}
37393746

3740-
// Note: We don't check file existence here because:
3741-
// 1. The file might be created later in the workflow
3742-
// 2. The container resolver will handle non-existent files with proper error messages
3743-
// 3. This allows for more flexible testing scenarios
3747+
exists, err := osinstaller.FileExists(filePath)
3748+
if err != nil {
3749+
return errors.Errorf("--container-images flag error: %v", err)
3750+
}
3751+
if !exists {
3752+
return errors.Errorf("--container-images flag error: file '%s' does not exist", filePath)
3753+
}
37443754

37453755
return nil
37463756
}
@@ -3790,14 +3800,16 @@ func validatePrefixedContainerImage(containerImage, prefix string) error {
37903800
// validateArchivePrefix validates archive-based prefixes (file:, docker-archive:, oci-archive:).
37913801
// Container-security scan-type related function.
37923802
func validateArchivePrefix(imageRef string) error {
3793-
// Note: We don't check file existence here for the same reasons as in validateFilePath
3794-
// The container resolver will handle non-existent files with proper error messages
3795-
3796-
// Check if user mistakenly used archive prefix with an image name:tag format
3797-
if strings.Contains(imageRef, ":") && !strings.HasSuffix(strings.ToLower(imageRef), ".tar") {
3798-
// This looks like they tried to use image:tag format with an archive prefix
3799-
// Provide a helpful hint
3800-
return errors.Errorf("--container-images flag error: archive prefix expects a file path, not image:tag format. Found: '%s'", imageRef)
3803+
exists, err := osinstaller.FileExists(imageRef)
3804+
if err != nil {
3805+
return errors.Errorf("--container-images flag error: %v", err)
3806+
}
3807+
if !exists {
3808+
// Check if user mistakenly used archive prefix with an image name:tag format
3809+
if strings.Contains(imageRef, ":") && !strings.HasSuffix(strings.ToLower(imageRef), ".tar") {
3810+
return errors.Errorf("--container-images flag error: file '%s' does not exist. Did you try to scan an image using image name and tag?", imageRef)
3811+
}
3812+
return errors.Errorf("--container-images flag error: file '%s' does not exist", imageRef)
38013813
}
38023814
return nil
38033815
}
@@ -3810,9 +3822,22 @@ func validateOCIDirPrefix(imageRef string) error {
38103822
// 2. Files (like .tar files)
38113823
// 3. Can have optional :tag suffix
38123824

3813-
// Note: We don't check path existence here for the same reasons as in validateFilePath
3814-
// The container resolver will handle non-existent paths with proper error messages
3825+
pathToCheck := imageRef
3826+
if strings.Contains(imageRef, ":") {
3827+
// Handle case like "oci-dir:/path/to/dir:tag" or "oci-dir:name.tar:tag"
3828+
pathParts := strings.Split(imageRef, ":")
3829+
if len(pathParts) > 0 && pathParts[0] != "" {
3830+
pathToCheck = pathParts[0]
3831+
}
3832+
}
38153833

3834+
exists, err := osinstaller.FileExists(pathToCheck)
3835+
if err != nil {
3836+
return errors.Errorf("--container-images flag error: path %s does not exist: %v", pathToCheck, err)
3837+
}
3838+
if !exists {
3839+
return errors.Errorf("--container-images flag error: path %s does not exist", pathToCheck)
3840+
}
38163841
return nil
38173842
}
38183843

‎internal/commands/scan_test.go‎

Lines changed: 20 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -2569,10 +2569,9 @@ func TestValidateContainerImageFormat_Comprehensive(t *testing.T) {
25692569
setupFiles: []string{"image-with-path.tar"},
25702570
},
25712571
{
2572-
name: "Valid - tar file (existence checked by container resolver)",
2572+
name: "Invalid - tar file does not exist",
25732573
containerImage: "nonexistent.tar",
2574-
expectedError: "",
2575-
setupFiles: []string{"nonexistent.tar"},
2574+
expectedError: "--container-images flag error: file 'nonexistent.tar' does not exist",
25762575
},
25772576

25782577
// ==================== Compressed Tar Tests ====================
@@ -2612,22 +2611,19 @@ func TestValidateContainerImageFormat_Comprehensive(t *testing.T) {
26122611
setupFiles: []string{"mysql_5.7_backup.tar"},
26132612
},
26142613
{
2615-
name: "Valid - Unix relative path (existence checked by container resolver)",
2614+
name: "Invalid - Unix relative path does not exist",
26162615
containerImage: "subdir/image.tar",
2617-
expectedError: "",
2618-
setupFiles: []string{"subdir/image.tar"},
2616+
expectedError: "--container-images flag error: file 'subdir/image.tar' does not exist",
26192617
},
26202618
{
2621-
name: "Valid - Unix nested path (existence checked by container resolver)",
2619+
name: "Invalid - Unix nested path does not exist",
26222620
containerImage: "path/to/archive/my-image.tar",
2623-
expectedError: "",
2624-
setupFiles: []string{"path/to/archive/my-image.tar"},
2621+
expectedError: "--container-images flag error: file 'path/to/archive/my-image.tar' does not exist",
26252622
},
26262623
{
2627-
name: "Valid - file path with version-like name (existence checked by container resolver)",
2624+
name: "Invalid - file path with version-like name does not exist",
26282625
containerImage: "Downloads/alpine_3.21.0_podman.tar",
2629-
expectedError: "",
2630-
setupFiles: []string{"Downloads/alpine_3.21.0_podman.tar"},
2626+
expectedError: "--container-images flag error: file 'Downloads/alpine_3.21.0_podman.tar' does not exist",
26312627
},
26322628

26332629
// ==================== Helpful Hints Tests ====================
@@ -2656,20 +2652,19 @@ func TestValidateContainerImageFormat_Comprehensive(t *testing.T) {
26562652
setupFiles: []string{"prefixed-image.tar"},
26572653
},
26582654
{
2659-
name: "Valid file prefix (existence checked by container resolver)",
2655+
name: "Invalid file prefix - missing file",
26602656
containerImage: "file:nonexistent.tar",
2661-
expectedError: "",
2662-
setupFiles: []string{"nonexistent.tar"},
2657+
expectedError: "--container-images flag error: file 'nonexistent.tar' does not exist",
26632658
},
26642659
{
26652660
name: "Hint - file prefix with image name",
26662661
containerImage: "file:nginx:latest",
2667-
expectedError: "--container-images flag error: archive prefix expects a file path, not image:tag format. Found: 'nginx:latest'",
2662+
expectedError: "--container-images flag error: file 'nginx:latest' does not exist. Did you try to scan an image using image name and tag?",
26682663
},
26692664
{
26702665
name: "Hint - file prefix with image (no tag)",
26712666
containerImage: "file:alpine:3.18",
2672-
expectedError: "--container-images flag error: archive prefix expects a file path, not image:tag format. Found: 'alpine:3.18'",
2667+
expectedError: "--container-images flag error: file 'alpine:3.18' does not exist. Did you try to scan an image using image name and tag?",
26732668
},
26742669

26752670
// ==================== Docker Archive Tests ====================
@@ -2680,15 +2675,14 @@ func TestValidateContainerImageFormat_Comprehensive(t *testing.T) {
26802675
setupFiles: []string{"image.tar"},
26812676
},
26822677
{
2683-
name: "Valid docker-archive (existence checked by container resolver)",
2678+
name: "Invalid docker-archive - missing file",
26842679
containerImage: "docker-archive:nonexistent.tar",
2685-
expectedError: "",
2686-
setupFiles: []string{"nonexistent.tar"},
2680+
expectedError: "--container-images flag error: file 'nonexistent.tar' does not exist",
26872681
},
26882682
{
26892683
name: "Hint - docker-archive with image name",
26902684
containerImage: "docker-archive:nginx:latest",
2691-
expectedError: "--container-images flag error: archive prefix expects a file path, not image:tag format. Found: 'nginx:latest'",
2685+
expectedError: "--container-images flag error: file 'nginx:latest' does not exist. Did you try to scan an image using image name and tag?",
26922686
},
26932687

26942688
// ==================== OCI Archive Tests ====================
@@ -2699,15 +2693,14 @@ func TestValidateContainerImageFormat_Comprehensive(t *testing.T) {
26992693
setupFiles: []string{"image.tar"},
27002694
},
27012695
{
2702-
name: "Valid oci-archive (existence checked by container resolver)",
2696+
name: "Invalid oci-archive - missing file",
27032697
containerImage: "oci-archive:nonexistent.tar",
2704-
expectedError: "",
2705-
setupFiles: []string{"nonexistent.tar"},
2698+
expectedError: "--container-images flag error: file 'nonexistent.tar' does not exist",
27062699
},
27072700
{
27082701
name: "Hint - oci-archive with image name",
27092702
containerImage: "oci-archive:ubuntu:22.04",
2710-
expectedError: "--container-images flag error: archive prefix expects a file path, not image:tag format. Found: 'ubuntu:22.04'",
2703+
expectedError: "--container-images flag error: file 'ubuntu:22.04' does not exist. Did you try to scan an image using image name and tag?",
27112704
},
27122705

27132706
// ==================== Docker Daemon Tests ====================
@@ -2793,10 +2786,9 @@ func TestValidateContainerImageFormat_Comprehensive(t *testing.T) {
27932786
setupDirs: []string{"oci-image-dir"},
27942787
},
27952788
{
2796-
name: "Valid oci-dir (existence checked by container resolver)",
2789+
name: "Invalid oci-dir - directory does not exist",
27972790
containerImage: "oci-dir:nonexistent-dir",
2798-
expectedError: "",
2799-
setupDirs: []string{"nonexistent-dir"},
2791+
expectedError: "--container-images flag error: path nonexistent-dir does not exist",
28002792
},
28012793
{
28022794
name: "Valid oci-dir with tar file",

0 commit comments

Comments
 (0)