-
Notifications
You must be signed in to change notification settings - Fork 358
Open
Labels
bugSomething isn't workingSomething isn't workingcommunityCommunity contributionCommunity contributionkubernetesKubernetes queryKubernetes queryqueryNew query featureNew query featureterraformTerraform queryTerraform query
Description
kics incorrectly detects valid labels as "Metadata Label Is Invalid"
Example:
resource "kubernetes_config_map" "gateway_class_defaults" {
metadata {
name = "gateway-class-defaults"
labels = {
"gateway.istio.io/defaults-for-class" = "something"
}
}
data = {
a = "b"
}
}Kubernetes allows a single slash: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set, which is a common pattern for labels and annotations.
The regex in kics does not: https://github.com/Checkmarx/kics/pull/2595/files#diff-613f4a5ed1b42d778d1dc4b070e5bde3cfbbd4606c24e2476ea5e95ff318f7dcR8
Expected Behavior
No error for labels with prefix
Actual Behavior
...
Metadata Label Is Invalid, Severity: LOW, Results: 3
Description: Check if any label in the metadata is invalid.
Platform: Terraform
CWE: 710
Risk Score: 3.3
Learn more about this vulnerability: https://docs.kics.io/latest/queries/terraform-queries/bc3dabb6-fd50-40f8-b9ba-7429c9f1fb0e
...
[3]: ../../data/gateway.tf:94
093:
094: labels = {
095: "gateway.istio.io/defaults-for-class" = "something"
...
Steps to Reproduce the Problem
Just scan the example above
Specifications
N/A
cx-artur-ribeiro
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't workingcommunityCommunity contributionCommunity contributionkubernetesKubernetes queryKubernetes queryqueryNew query featureNew query featureterraformTerraform queryTerraform query