Skip to content

bug(terraform): Detecting valid label as invalidΒ #7938

@SimonDreher

Description

@SimonDreher

kics incorrectly detects valid labels as "Metadata Label Is Invalid"

Example:

resource "kubernetes_config_map" "gateway_class_defaults" {
  metadata {
    name = "gateway-class-defaults"
    labels = {
      "gateway.istio.io/defaults-for-class" = "something"
    }
  }

  data = {
    a = "b"
  }
}

Kubernetes allows a single slash: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set, which is a common pattern for labels and annotations.

The regex in kics does not: https://github.com/Checkmarx/kics/pull/2595/files#diff-613f4a5ed1b42d778d1dc4b070e5bde3cfbbd4606c24e2476ea5e95ff318f7dcR8

Expected Behavior

No error for labels with prefix

Actual Behavior

...
Metadata Label Is Invalid, Severity: LOW, Results: 3
Description: Check if any label in the metadata is invalid.
Platform: Terraform
CWE: 710
Risk Score: 3.3
Learn more about this vulnerability: https://docs.kics.io/latest/queries/terraform-queries/bc3dabb6-fd50-40f8-b9ba-7429c9f1fb0e

...

	[3]: ../../data/gateway.tf:94

		093: 
		094:     labels = {
		095:       "gateway.istio.io/defaults-for-class" = "something"

...

Steps to Reproduce the Problem

Just scan the example above

Specifications

N/A

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingcommunityCommunity contributionkubernetesKubernetes queryqueryNew query featureterraformTerraform query

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions