Repository: Checkmarx/kics (language: python)

Issue:
bug(parser): evaluating Terrform functions with null values as params
when running a scan of a terraform file and a variables file such as:
_main.tf_

```
resource "aws_vpc" "my_vpc" {
  cidr_block = "172.16.0.0/16"

  tags = {
  Name = format("my-vpc-%s", var.name)
  Name2 = format("my-vpc-%s", var.name2)
  }
}
```
_variables.tf_

```
variable "name" {
  type        = string
  default     = null
  description = "just a name"
}

variable "name2" {
  type        = string
  default     = "name2"
  description = "just another name"
}
```

kics scan will fail with the following error:
```
                   .0MO.                                    
                   OMMMx                                    
                   ;NMX;                                    
                    ...           ...              ....     
WMMMd     cWMMM0.  KMMMO      ;xKWMMMMNOc.     ,xXMMMMMWXkc.
WMMMd   .0MMMN:    KMMMO    :XMMMMMMMMMMMWl   xMMMMMWMMMMMMl
WMMMd  lWMMMO.     KMMMO   xMMMMKc...'lXMk   ,MMMMx   .;dXx 
WMMMd.0MMMX;       KMMMO  cMMMMd        '    'MMMMNl'       
WMMMNWMMMMl        KMMMO  0MMMN               oMMMMMMMXkl.  
WMMMMMMMMMMo       KMMMO  0MMMX                .ckKWMMMMMM0.
WMMMMWokMMMMk      KMMMO  oMMMMc              .     .:OMMMM0
WMMMK.  dMMMM0.    KMMMO   KMMMMx'    ,kNc   :WOc.    .NMMMX
WMMMd    cWMMMX.   KMMMO    kMMMMMWXNMMMMMd .WMMMMWKO0NMMMMl
WMMMd     ,NMMMN,  KMMMO     'xNMMMMMMMNx,   .l0WMMMMMMMWk, 
xkkk:      ,kkkkx  okkkl        ;xKXKx;          ;dOKKkc    


Scanning with Keeping Infrastructure as Code Secure v1.7.11


Preparing Scan Assets: Done                                                                                                                                                                                                                                                                                             
Error: failed to read sources: failed to save file content: json: error calling MarshalJSON for type model.Document: value is not known
Usage:
  kics scan [flags]

Flags:
  -m, --bom                           include bill of materials (BoM) in results output
......
```


Discussion / hints:

Fix patch:
diff --git a/pkg/parser/terraform/converter/default.go b/pkg/parser/terraform/converter/default.go
index 3d728ce37c9..baf9cb17c19 100644
--- a/pkg/parser/terraform/converter/default.go
+++ b/pkg/parser/terraform/converter/default.go
@@ -496,6 +496,12 @@ func (c *converter) evalFunction(expression hclsyntax.Expression) (interface{},
 			return c.wrapExpr(expression)
 		}
 	}
+	if !expressionEvaluated.HasWhollyKnownType() {
+		// in some cases, the expression is evaluated with no error but the type is unknown.
+		// this causes the json marshaling of the Document later on to fail with an error, and the entire scan fails.
+		// Therefore, we prefer to wrap it as a string and continue the scan.
+		return c.wrapExpr(expression)
+	}
 	return ctyjson.SimpleJSONValue{Value: expressionEvaluated}, nil
 }
 


Test patch:
diff --git a/e2e/fixtures/E2E_CLI_071_PAYLOAD.json b/e2e/fixtures/E2E_CLI_071_PAYLOAD.json
new file mode 100644
index 00000000000..73b02b91169
--- /dev/null
+++ b/e2e/fixtures/E2E_CLI_071_PAYLOAD.json
@@ -0,0 +1,19 @@
+{
+	"document": [
+		{
+			"id": "0",
+			"resource": {
+				"aws_vpc": {
+					"my_vpc": {
+						"cidr_block": "172.16.0.0/16",
+						"tags": {
+							"Name": "${format(\"my-vpc-%s\", var.name)}",
+							"Name2": "my-vpc-name2"
+						}
+					}
+				}
+			},
+			"file": "file"
+		}
+	]
+}
diff --git a/e2e/fixtures/samples/tf-eval-func-unknown-type/main.tf b/e2e/fixtures/samples/tf-eval-func-unknown-type/main.tf
new file mode 100644
index 00000000000..ec914cb62db
--- /dev/null
+++ b/e2e/fixtures/samples/tf-eval-func-unknown-type/main.tf
@@ -0,0 +1,8 @@
+resource "aws_vpc" "my_vpc" {
+  cidr_block = "172.16.0.0/16"
+
+  tags = {
+  Name = format("my-vpc-%s", var.name)
+  Name2 = format("my-vpc-%s", var.name2)
+  }
+}
diff --git a/e2e/fixtures/samples/tf-eval-func-unknown-type/variables.tf b/e2e/fixtures/samples/tf-eval-func-unknown-type/variables.tf
new file mode 100644
index 00000000000..8a15880e410
--- /dev/null
+++ b/e2e/fixtures/samples/tf-eval-func-unknown-type/variables.tf
@@ -0,0 +1,11 @@
+variable "name" {
+  type        = string
+  default     = null
+  description = "just a name"
+}
+
+variable "name2" {
+  type        = string
+  default     = "name2"
+  description = "just another name"
+}
diff --git a/e2e/testcases/e2e-cli-071_tf_eval_func_unknown_type.go b/e2e/testcases/e2e-cli-071_tf_eval_func_unknown_type.go
new file mode 100644
index 00000000000..2a68c32d74e
--- /dev/null
+++ b/e2e/testcases/e2e-cli-071_tf_eval_func_unknown_type.go
@@ -0,0 +1,22 @@
+// Package testcases provides end-to-end (E2E) testing functionality for the application.
+package testcases
+
+// E2E-CLI-071 - KICS scan while evaluating the terraform functions with unknown type
+// should perform the scan successfully and return exit code 40
+func init() { //nolint
+	testSample := TestCase{
+		Name: "should perform a valid scan while evaluating the terraform functions with unknown type [E2E-CLI-071]",
+		Args: args{
+			Args: []cmdArgs{
+				[]string{"scan", "-p", "\"/path/e2e/fixtures/samples/tf-eval-func-unknown-type/main.tf\"",
+					"--silent", "--payload-path", "/path/e2e/output/E2E_CLI_071_PAYLOAD.json"},
+			},
+			ExpectedPayload: []string{
+				"E2E_CLI_071_PAYLOAD.json",
+			},
+		},
+		WantStatus: []int{40},
+	}
+
+	Tests = append(Tests, testSample)
+}