cwielenb/CNCF-Dataset huggingface dataset:
Project: TDengine (App Definition and Development / Database)
File: 14-dbeaver.md

sidebar_label: DBeaver title: DBeaver description: You can use DBeaver to access your data stored in TDengine and TDengine Cloud. is a popular cross-platform database management tool that facilitates data management for developers, database administrators, data analysts, and other users. Starting from version 23.1.1, DBeaver natively supports TDengine and can be used to manage TDengine Cloud as well as TDengine clusters deployed on-premises. To use DBeaver to manage TDengine, you need to prepare the following: Install DBeaver. DBeaver supports mainstream operating systems including Windows, macOS, and Linux. Please make sure you download and install the correct version (23.1.1+) and platform package. Please refer to the for detailed installation steps. If you use an on-premises TDengine cluster, please make sure that TDengine and taosAdapter are deployed and running properly. For detailed information, please refer to the taosAdapter User Manual. Start the DBeaver application, click the button or menu item to choose New Database Connection, and then select TDengine in the Timeseries category. Configure the TDengine connection by filling in the host address, port number, username, and password. If TDengine is deployed on the local machine, you are only required to fill in the username and password. The default username is root and the default password is taosdata. Click Test Connection to check whether the connection is workable. If you do not have the TDengine Java client library installed on the local machine, DBeaver will prompt you to download and install it. ) If the connection is successful, it will be displayed as shown in the following figure. If the connection fails, please check whether the TDengine service and taosAdapter are running correctly and whether the host address, port number, username, and password are correct. Use DBeaver to select databases and tables and browse your data stored in TDengine. You can also manipulate TDengine data by executing SQL commands.
Project: Beam (App Definition and Development / Streaming & Messaging)
File: sum.md

title: "Sum" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> {{< localstorage language language-py >}} {{< button-pydoc path="apache_beam.transforms.core" class="CombineGlobally" >}} Sums all the elements within each aggregation. In the following example, we create a pipeline with a `PCollection`. Then, we get the sum of all the element values in different ways. We use `Combine.Globally()` to get sum of all the element values from the entire `PCollection`. {{< playground height="700px" >}} {{< playgroundsnippet language="py" path="SDKPYTHONSumGlobally" show="sumglobally" >}} {{< /playground >}} We use `Combine.PerKey()` to get the sum of all the element values for each unique key in a `PCollection` of key-values. {{< playground height="700px" >}} {{< playgroundsnippet language="py" path="SDKPYTHONSumPerKey" show="sumper_ke" >}} {{< /playground >}} {{< button-pydoc path="apache_beam.transforms.core" class="CombineGlobally" >}}
Project: Chef InSpec (Provisioning / Security & Compliance)
File: postgres_hba_conf.md

+++ title = "postgreshbaconf resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "postgreshbaconf" identifier = "inspec/resources/os/postgreshbaconf.md postgreshbaconf resource" parent = "inspec/resources/os" +++ Use the `postgreshbaconf` Chef InSpec audit resource to test the client authentication data defined in the pg_hba.conf file. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.31.0 of InSpec. An `postgreshbaconf` Chef InSpec audit resource block declares client authentication data that should be tested: describe postgreshbaconf.where { type == 'local' } do its('auth_method') { should eq ['peer'] } end where `'attribute'` is a attribute in the pg hba configuration file `'filter_value'` is the value that is to be filtered for `'value'` is the value that is to be matched expected `address` returns a an array of strings that matches the where condition of the filter table describe postgreshbaconf.where { type == 'local' } do its('address') { should cmp 'value' } end `auth_method` returns a an array of strings that matches the where condition of the filter table describe postgreshbaconf.where { type == 'local' } do its('auth_method') { should cmp 'value' } end `database` returns a an array of strings that matches the where condition of the filter table describe postgreshbaconf.where { type == 'local' } do its('database') { should cmp 'value' } end `type` returns a an array of strings that matches the where condition of the filter table describe postgreshbaconf.where { database == 'acmetestdb' } do its('type') { should cmp 'value' } end `user` returns a an array of strings that matches the where condition of the filter table describe postgreshbaconf.where { database == 'acmetestdb' } do its('user') { should cmp 'value' } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: KICS (Provisioning / Security & Compliance)
File: 581dae78-307d-45d5-aae4-fe2b0db267a5.md

title: Azure Container Registry With No Locks hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 581dae78-307d-45d5-aae4-fe2b0db267a5 Query name: Azure Container Registry With No Locks Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: Azurerm Container Registry should contain associated locks, which means 'azurermlock.managedresourceid' or 'azurermlock.resource_group' association should be defined<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="17 2" name: Create an azure container registry azurermcontainerregistry: name: myRegistry location: eastus resource_group: myResourceGroupFake adminuserenabled: true sku: Premium tags: Release: beta1 Environment: Production name: Create a lock for a resource group azurermlock: resource_group: myResourceGroup32 name: myLock level: read_only name: Create an azure container registry2 azure.azcollection.azurermcontainerregistry: name: myRegistry location: eastus resource_group: someResourceGroup adminuserenabled: "true" sku: Premium tags: Release: beta1 Environment: Production ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="2" name: Create an azure container registryy1 azure.azcollection.azurermcontainerregistry: name: myRegistry location: eastus adminuserenabled: "true" sku: Premium tags: Release: beta1 Environment: Production register: acr name: "Create lock for ACR1" azure.azcollection.azurermlock: managedresourceid: "{{ acr3.id }}" name: "acr_lock" level: cannotdelete ``` ```yaml title="Negative test num. 1 - yaml file" name: Create an azure container registry azurermcontainerregistry: name: myRegistry location: eastus resource_group: myResourceGroup adminuserenabled: true sku: Premium tags: Release: beta1 Environment: Production name: Create a lock for a resource group azurermlock: resource_group: myResourceGroup name: myLock level: read_only ``` ```yaml title="Negative test num. 2 - yaml file" name: Create an azure container registry11 azure.azcollection.azurermcontainerregistry: name: myRegistry location: eastus adminuserenabled: "true" sku: Premium tags: Release: beta1 Environment: Production register: acr2 name: "Create lock for ACR11" azure.azcollection.azurermlock: managedresourceid: "{{ acr2.id }}" name: "acr_lock" level: cannotdelete ```
Project: YugabyteDB (App Definition and Development / Database)
File: array-position.md

title: arrayposition() and arraypositions() linkTitle: arrayposition(), arraypositions() headerTitle: arrayposition() and arraypositions() description: arrayposition() and arraypositions() menu: v2.18: identifier: array-position parent: array-functions-operators type: docs These functions require that the to-be-searched array is one-dimensional. They return the index values of the specified to-be-searched-for value in the specified to-be-searched array. Create a function to return the test array: ```plpgsql drop function if exists arr() cascade; create function arr() returns text[] language sql as $body$ select array[ 'mon', 'tue', 'wed', 'thu','fri', 'sat', 'sun', 'mon', 'tue', 'wed', 'thu','fri', 'sat', 'sun', 'mon', 'tue', 'wed' ]; $body$; ``` List the elements of the daysarr column (in the only row that the view produces) by their index number. Use the built-in function _. ```plpgsql with c(days, pos) as ( select a, subscripts.pos from arr() as a cross join lateral generate_subscripts(arr(), 1) as subscripts(pos)) select pos, days[pos] as day from c order by pos; ``` This is the result: ```output pos | day --+-- 1 | mon 2 | tue 3 | wed 4 | thu 5 | fri 6 | sat 7 | sun 8 | mon 9 | tue 10 | wed 11 | thu 12 | fri 13 | sat 14 | sun 15 | mon 16 | tue 17 | wed ``` The examples below use the arr() function value. Purpose: Return the index, in the supplied array, of the specified value. Optionally, starts searching at the specified index. Signature: ```output input value: anyarray, anyelement [, int] return value: int ``` Note: The optional third parameter specifies the inclusive index value at which to start the search. Example: ```plpgsql select array_position( arr(), -- The to-be-searched array. 'tue'::text, -- The to-be-searched-for value. 3::int -- The (inclusive) position -- at which to start searching. [optional] ) as position; ``` This is the result: ```output position 9 ``` Purpose: Return the indexes, in the supplied array, of all occurrences of the specified value. Signature: ```output input value: anyarray, anyelement return value: integer[] ``` Example: This example uses the built-in function to present the elements of the array that arraypositions()_ returns as a table: ```plpgsql select unnest( array_positions( arr(), -- The to-be-searched array. 'tue'::text -- The to-be-searched-for value. ) ) as position; ``` This is the result: ```output position 2 9 16 ```
Project: Checkov (Provisioning / Security & Compliance)
File: Scanning Credentials and Secrets.md

layout: default published: true title: Scanning Credentials and Secrets nav_order: 5 Checkov can scan for a number of different common credentials such as AWS access keys, Azure service credentials, or private keys that are hard-coded in a Terraform code block. See list of regular expressions . Lets assume we have the following Terraform provider block: ```yaml provider "aws" { region = "us-west-2" access_key = "AKIAIOSFODNN7EXAMPLE" secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } ``` As stated in Terraform's documentation: Hard-coding credentials into any Terraform configuration is not recommended, and risks secret leakage should this file ever be committed to a public version control system. Run Checkov to detect secrets: ```shell checkov -f main.tf ``` This is the output of the scan ```text _| | _ | | / | '_ \ / _ \/ | |/ / _ \ \ / / | (| | | | / (| < (_) \ V / \_|_| |_|\|\|_|\_\/ \/ version: 1.0.202 terraform scan results: Passed checks: 0, Failed checks: 1, Skipped checks: 0 Check: CKVAWS41: "Ensure no hard coded AWS access key and secret key exists" FAILED for resource: provider.aws File: :1-5 1 | provider "aws" { 2 | region = "us-west-2" 3 | access_key = "AKIAIOSFODNN7EXAMPLE" 4 | secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" 5 | } ``` Checkov can also detect secrets defined in lambda variables as shown in the example below. ```yaml resource "awslambdafunction" "test_lambda" { filename = "resources/lambdafunctionpayload.zip" functionname = "${local.resourceprefix.value}-analysis" role = "${awsiamrole.iamforlambda.arn}" handler = "exports.test" sourcecodehash = "${filebase64sha256("resources/lambdafunctionpayload.zip")}" runtime = "nodejs12.x" environment { variables = { access_key = "AKIAIOSFODNN7EXAMPLE" secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } } ``` or in EC2 user data as shown in the example below: ```yaml resource "awsinstance" "computehost" { ami = "ami-04169656fea786776" instance_type = "t2.nano" user_data = <<EOF sudo apt-get update sudo apt-get install -y apache2 sudo systemctl start apache2 sudo systemctl enable apache2 export AWSACCESSKEY_ID export AWSACCESSKEY_ID=AKIAIOSFODNN7EXAMPLE export AWSSECRETACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY export AWSDEFAULTREGION=us-west-2 echo "<h1>Deployed via Terraform</h1>" | sudo tee /var/www/html/index.html EOF tags = { Name = "${local.resource_prefix.value}-ec2" } } ```
Project: SPIRE (Provisioning / Key Management)
File: plugin_server_nodeattestor_tpm_devid.md

Must be used in conjunction with the agent-side tpm_devid plugin The `tpm_devid` plugin attests nodes that own a TPM and that have been provisioned with a DevID certificate through an out-of-band mechanism. The plugin issues two challenges to the agent: A proof-of-possession challenge: This is required to verify the node is in possession of the private key that corresponds to the DevID certificate. Additionally, the server verifies that the DevID certificate is rooted to a trusted set of CAs. A proof-of-residency challenge: This is required to prove that the DevID key pair was generated and resides in a TPM. Additionally, the server verifies that the TPM is authentic by verifying that the endorsement certificate is rooted to a trusted set of manufacturer CAs. The SPIFFE ID produced by the plugin is based on the certificate fingerprint, where the fingerprint is defined as the SHA1 hash of the ASN.1 DER encoding of the identity certificate. The SPIFFE ID has the form: ```xml spiffe://<trustdomain>/spire/agent/tpmdevid/<fingerprint> ``` | Configuration | Description | Default | |-||| | `devidcapath` | The path to the trusted CA certificate(s) on disk to use for DevID validation. The file must contain one or more PEM blocks forming the set of trusted root CA's for chain-of-trust verification. | | | `endorsementcapath` | The path to the trusted manufacturer CA certificate(s) on disk. The file must contain one or more PEM blocks forming the set of trusted manufacturer CA's for chain-of-trust verification. | | A sample configuration: ```hcl NodeAttestor "tpm_devid" { plugin_data { devidcapath = "/opt/spire/conf/server/devid-cacert.pem" endorsementcapath = "/opt/spire/conf/server/endorsement-cacert.pem" } } ``` | Selector | Example | Description | |--|-|| | Subject common name | `tpm_devid:subject:cn:example.org` | The subject's common name. | | Issuer common name | `tpm_devid:issuer:cn:authority.org` | The issuer's common name. | | SHA1 fingerprint | `tpm_devid:fingerprint:9ba51e2643bea24e91d24bdec3a1aaf8e967b6e5` | The SHA1 fingerprint as a hex string for each cert in the PoP chain, excluding the leaf. |
Project: ORY Hydra (Provisioning / Key Management)
File: MetadataApi.md

All URIs are relative to http://localhost Method | HTTP request | Description | - | - | Get /version | Return Running Software Version. | Get /health/alive | Check HTTP Server Status | Get /health/ready | Check HTTP Server and Database Status GetVersion200Response GetVersion(ctx).Execute() Return Running Software Version. ```go package main import ( "context" "fmt" "os" openapiclient "github.com/ory/hydra-client-go/v2" ) func main() { configuration := openapiclient.NewConfiguration() apiClient := openapiclient.NewAPIClient(configuration) resp, r, err := apiClient.MetadataApi.GetVersion(context.Background()).Execute() if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `MetadataApi.GetVersion``: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } // response from `GetVersion`: GetVersion200Response fmt.Fprintf(os.Stdout, "Response from `MetadataApi.GetVersion`: %v\n", resp) } ``` This endpoint does not need any parameter. Other parameters are passed through a pointer to a apiGetVersionRequest struct via the builder pattern No authorization required Content-Type: Not defined Accept: application/json HealthStatus IsAlive(ctx).Execute() Check HTTP Server Status ```go package main import ( "context" "fmt" "os" openapiclient "github.com/ory/hydra-client-go/v2" ) func main() { configuration := openapiclient.NewConfiguration() apiClient := openapiclient.NewAPIClient(configuration) resp, r, err := apiClient.MetadataApi.IsAlive(context.Background()).Execute() if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `MetadataApi.IsAlive``: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } // response from `IsAlive`: HealthStatus fmt.Fprintf(os.Stdout, "Response from `MetadataApi.IsAlive`: %v\n", resp) } ``` This endpoint does not need any parameter. Other parameters are passed through a pointer to a apiIsAliveRequest struct via the builder pattern No authorization required Content-Type: Not defined Accept: application/json IsReady200Response IsReady(ctx).Execute() Check HTTP Server and Database Status ```go package main import ( "context" "fmt" "os" openapiclient "github.com/ory/hydra-client-go/v2" ) func main() { configuration := openapiclient.NewConfiguration() apiClient := openapiclient.NewAPIClient(configuration) resp, r, err := apiClient.MetadataApi.IsReady(context.Background()).Execute() if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `MetadataApi.IsReady``: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } // response from `IsReady`: IsReady200Response fmt.Fprintf(os.Stdout, "Response from `MetadataApi.IsReady`: %v\n", resp) } ``` This endpoint does not need any parameter. Other parameters are passed through a pointer to a apiIsReadyRequest struct via the builder pattern No authorization required Content-Type: Not defined Accept: application/json
Project: Chef InSpec (Provisioning / Security & Compliance)
File: mysql_session.md

+++ title = "mysql_session resource" draft = false gh_repo = "inspec" platform = "os" [menu] [menu.inspec] title = "mysql_session" identifier = "inspec/resources/os/mysqlsession.md mysqlsession resource" parent = "inspec/resources/os" +++ Use the `mysql_session` Chef InSpec audit resource to test SQL commands run against a MySQL database. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. A `mysql_session` resource block declares the username and password to use for the session, and then the command to be run: describe mysql_session('username', 'password').query('QUERY') do its('output') { should match(/expected-result/) } end where `mysql_session` declares a username and password, connecting locally, with permission to run the query `query('QUERY')` contains the query to be run `its('output') { should eq(/expected-result/) }` compares the results of the query against the expected result in the test The following examples show how to use this Chef InSpec audit resource. sql = mysqlsession('myuser','password') describe sql.query('show databases like \'test\';') do its('output') { should_not match(/test/) } end sql = mysqlsession('myuser','password','db.example.com') sql = mysqlsession('myuser','password','localhost',3307) sql = mysqlsession('myuser','password', nil, nil, '/var/lib/mysql-default/mysqld.sock') describe mysqlsession('myuser','password').query('show tables in existing_database;') do its('exit_status') { should eq(0) } end describe mysqlsession('myuser','password').query('show tables in nonexistentdatabase;') do its('exitstatus') { shouldnot eq(0) } end describe mysqlsession('myuser','password').query('show tables in nonexistentdatabase;') do its('stderr') { should match(/Unknown database/) } end This Chef InSpec audit resource builds a object and returns the the result object. {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: KICS (Provisioning / Security & Compliance)
File: ba066cda-e808-450d-92b6-f29109754d45.md

title: Callback Object With Incorrect Ref hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ba066cda-e808-450d-92b6-f29109754d45 Query name: Callback Object With Incorrect Ref Platform: OpenAPI Severity: <span style="color:#5bc0de">Info</span> Category: Structure and Semantics URL: Callback Object reference must always point to '#/components/callbacks'<br> ```json title="Positive test num. 1 - json file" hl_lines="19" { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "$ref": "#/components/schemas/Success" } }, "callbacks": { "myEvent": { "$ref": "#/components/callbaccgcks/inProgress" } } } } }, "components": { "callbacks": { "inProgress": { "{$request.body#/inProgressUrl}": { "post": { "requestBody": { "$ref": "#/components/requestBodies/callbackMessage1" }, "responses": { "200": { "description": "OK" } } } } } } } } ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="15" openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": $ref: "#/components/schemas/Success" callbacks: myEvent: $ref: "#/components/callbaccgcks/inProgress" components: callbacks: inProgress: "{$request.body#/inProgressUrl}": post: requestBody: $ref: "#/components/requestBodies/callbackMessage1" responses: "200": description: OK ``` ```json title="Negative test num. 1 - json file" { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "$ref": "#/components/schemas/Success" } }, "callbacks": { "myEvent": { "$ref": "#/components/callbacks/inProgress" } } } } }, "components": { "callbacks": { "inProgress": { "{$request.body#/inProgressUrl}": { "post": { "requestBody": { "$ref": "#/components/requestBodies/callbackMessage1" }, "responses": { "200": { "description": "OK" } } } } } } } } ``` ```yaml title="Negative test num. 2 - yaml file" openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": $ref: "#/components/schemas/Success" callbacks: myEvent: $ref: "#/components/callbacks/inProgress" components: callbacks: inProgress: "{$request.body#/inProgressUrl}": post: requestBody: $ref: "#/components/requestBodies/callbackMessage1" responses: "200": description: OK ```