internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: bridgecrewio/checkov

Issue:
Terraform azurerm_windows_function_app  resource - CKV_SECRET_6 false positive for active_directory_v2 setting
**Describe the issue**
When adding azure function app with identity provider active directory v2, checkov reports false positive
secret is not exposed but checkov reports :

|  0 | CKV_SECRET_6 | xxxxxxxxx| 0a69b97b56bf2230f607111888418a59f1891c92 | Base64 High Entropy String | https://docs.paloaltonetworks.com/content/techdocs/en_US/prisma/prisma-cloud/prisma-cloud-code-security-policy-reference/secrets-policies/secrets-policy-index/git-secrets-6.html |

with resource 0a69b97b56bf2230f607111888418a59f1891c92

Because from resource id is not clear which resource is the culprit the only possible one is client_secret_setting_name  which is set to 
"MICROSOFT_PROVIDER_AUTHENTICATION_SECRET" and not exposed secret. 
**Examples**

snippet of resource azurerm_windows_function_app :

    active_directory_v2 {
      client_id                   = local.managed_identity_client_id
      client_secret_setting_name  = "MICROSOFT_PROVIDER_AUTHENTICATION_SECRET"
      tenant_auth_endpoint        = local.identity_provider.tenant_auth_endpoint
      www_authentication_disabled = false
    }

**Version (please complete the following information):**
 - Checkov Version 2.4.50

**Additional context**
Add any other context about the problem here.



Discussion:
hey @vigor-vavan thanks for reaching out.

Especially `CKV_SECRET_6` can result in false positives, but always a good idea to revisit and if possible improving it.

Resolving patch:
diff --git a/checkov/secrets/plugins/detector_utils.py b/checkov/secrets/plugins/detector_utils.py
--- a/checkov/secrets/plugins/detector_utils.py
+++ b/checkov/secrets/plugins/detector_utils.py
@@ -108,7 +108,13 @@
     flags=re.IGNORECASE,
 )
 
-ALLOW_LIST = ('secretsmanager', "secretName", "secret_name", "creation_token")  # can add more keys like that
+ALLOW_LIST = (  # can add more keys like that
+    'secretsmanager',
+    "secretName",
+    "secret_name",
+    "creation_token",
+    "client_secret_setting_name",
+)
 ALLOW_LIST_REGEX = r'|'.join(ALLOW_LIST)
 # Support for suffix of function name i.e "secretsmanager:GetSecretValue"
 CAMEL_CASE_NAMES = r'[A-Z]([A-Z0-9]*[a-z][a-z0-9]*[A-Z]|[a-z0-9]*[A-Z][A-Z0-9]*[a-z])[A-Za-z0-9]*'


Test patch:
diff --git a/tests/secrets/sanity/iac_fp/main.tf b/tests/secrets/sanity/iac_fp/main.tf
--- a/tests/secrets/sanity/iac_fp/main.tf
+++ b/tests/secrets/sanity/iac_fp/main.tf
@@ -1,3 +1,5 @@
 secret_name       = "example_secret_name"
 
-creation_token                  = "my-product"
\ No newline at end of file
+creation_token                  = "my-product"
+
+client_secret_setting_name  = "MICROSOFT_PROVIDER_AUTHENTICATION_SECRET"
Repository: bridgecrewio/checkov

Issue:
Terraform check "CKV_AZURE_158" - Typo within the name
**Describe the issue**
It seems that there is a typo within the name of the check CKV_AZURE_158 for Terraform resources.

**Examples**
````python
from checkov.common.models.enums import CheckCategories, CheckResult
from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck
from typing import List, Any


class DatabricksWorkspaceIsNotPublic(BaseResourceNegativeValueCheck):
    def __init__(self):
        name = "Ensure that databricks workspace has not public"
        id = "CKV_AZURE_158"
        supported_resources = ['azurerm_databricks_workspace']
        categories = [CheckCategories.NETWORKING]
        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,
                         missing_attribute_result=CheckResult.FAILED)

    def get_inspected_key(self) -> str:
        return 'public_network_access_enabled'

    def get_forbidden_values(self) -> List[Any]:
        return [True]


check = DatabricksWorkspaceIsNotPublic()
````


**Version (please complete the following information):**
 Current
 
 
**Additional context**
N/A


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/azure/DatabricksWorkspaceIsNotPublic.py b/checkov/terraform/checks/resource/azure/DatabricksWorkspaceIsNotPublic.py
--- a/checkov/terraform/checks/resource/azure/DatabricksWorkspaceIsNotPublic.py
+++ b/checkov/terraform/checks/resource/azure/DatabricksWorkspaceIsNotPublic.py
@@ -5,7 +5,7 @@
 
 class DatabricksWorkspaceIsNotPublic(BaseResourceNegativeValueCheck):
     def __init__(self):
-        name = "Ensure that databricks workspace has not public"
+        name = "Ensure that databricks workspace is not public"
         id = "CKV_AZURE_158"
         supported_resources = ['azurerm_databricks_workspace']
         categories = [CheckCategories.NETWORKING]


Test patch:
Repository: bridgecrewio/checkov

Issue:
Documentation formatter is turning "--" into "–" (en dash) in the description field
In the [CLI Command Reference](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html) documentation, all the examples that use `--` options in the "Description" column are coming through as `–` (en dash). This makes it impossible to actually copy these examples for use. They are correct in [the Markdown source file](https://github.com/bridgecrewio/checkov/blob/main/docs/2.Basics/CLI%20Command%20Reference.md). To verify, use the browser search for `--output-file-path` and you'll find only one search result instead of two.


Discussion:

Resolving patch:
diff --git a/checkov/common/parallelizer/parallel_runner.py b/checkov/common/parallelizer/parallel_runner.py
--- a/checkov/common/parallelizer/parallel_runner.py
+++ b/checkov/common/parallelizer/parallel_runner.py
@@ -55,10 +55,12 @@ def run_function(
 
     def _run_function_multiprocess_fork(
         self, func: Callable[[Any], _T], items: List[Any], group_size: Optional[int]
-    ) -> Generator[_T, None, Iterable[_T]]:
+    ) -> Generator[_T, None, None]:
         if multiprocessing.current_process().daemon:
             # can't fork, when already inside a pool
-            return self._run_function_multithreaded(func, items)  # noqa: B901
+            for result in self._run_function_multithreaded(func, items):
+                yield result
+            return
 
         if not group_size:
             group_size = int(len(items) / self.workers_number) + 1
@@ -101,8 +103,6 @@ def func_wrapper(original_func: Callable[[Any], _T], items_group: List[Any], con
                 except EOFError:
                     pass
 
-        return []
-
     def _run_function_multiprocess_spawn(
         self, func: Callable[[Any], _T], items: list[Any], group_size: int | None
     ) -> Iterable[_T]:


Test patch:
Repository: bridgecrewio/checkov

Issue:
Versions 3.1.0 and up fails when credentials for BridgeCrew integration is missing.
**Describe the issue**
The changes introduced in https://github.com/bridgecrewio/checkov/pull/5760/files#diff-2ce0ea68256051d5aa80a54fb68b2e7ec9c3802f3cb2c6a8efa957ddf18255e8R131 causes all of our CI pipelines that use `checkov` to fail.

It works fine with versions 3.0.40 and below.

**Exception Trace**
```sh
File "/.../site-packages/checkov/common/bridgecrew/platform_integration.py", line 397, in set_s3_client 
    raise ValueError("Credentials for client are not set")
```

**Desktop (please complete the following information):**
 - OS: Windows (WSL) & Ubuntu
 - Checkov Version >= 3.1.0



Discussion:
Same error here which causes our CI pipelines to fail also

Resolving patch:
diff --git a/checkov/secrets/runner.py b/checkov/secrets/runner.py
--- a/checkov/secrets/runner.py
+++ b/checkov/secrets/runner.py
@@ -128,7 +128,9 @@ def run(
         if bc_integration.daemon_process:
             # only happens for 'ParallelizationType.SPAWN'
             bc_integration.setup_http_manager()
-            bc_integration.set_s3_client()
+            if bc_integration.bc_api_key:
+                # only initialize, if API key was used
+                bc_integration.set_s3_client()
 
         # load runnable plugins
         customer_run_config = bc_integration.customer_run_config_response


Test patch:
Repository: bridgecrewio/checkov

Issue:
CKV_GCP_79 SQL Server latest version is 2022 instead of 2019
**Describe the issue**
The `CKV_GCP_79` about SQL server is pinned at 2019 but 2022 is the latest version : 
https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

**Examples**
Related to this files : 

https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/gcp/CloudSqlMajorVersion.py

https://github.com/bridgecrewio/checkov/blob/d07fdc994015772a9fa0dc1a12d1391b5765916c/tests/terraform/checks/resource/gcp/example_CloudSqlMajorVersion/main.tf#L213


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/gcp/CloudSqlMajorVersion.py b/checkov/terraform/checks/resource/gcp/CloudSqlMajorVersion.py
--- a/checkov/terraform/checks/resource/gcp/CloudSqlMajorVersion.py
+++ b/checkov/terraform/checks/resource/gcp/CloudSqlMajorVersion.py
@@ -14,8 +14,8 @@ def get_inspected_key(self):
         return 'database_version'
 
     def get_expected_values(self):
-        return ["POSTGRES_15", "MYSQL_8_0", "SQLSERVER_2019_STANDARD", "SQLSERVER_2019_WEB",
-                "SQLSERVER_2019_ENTERPRISE", "SQLSERVER_2019_EXPRESS"]
+        return ["POSTGRES_15", "MYSQL_8_0", "SQLSERVER_2022_STANDARD", "SQLSERVER_2022_WEB",
+                "SQLSERVER_2022_ENTERPRISE", "SQLSERVER_2022_EXPRESS"]
 
 
 check = CloudSqlMajorVersion()


Test patch:
diff --git a/tests/terraform/checks/resource/gcp/example_CloudSqlMajorVersion/main.tf b/tests/terraform/checks/resource/gcp/example_CloudSqlMajorVersion/main.tf
--- a/tests/terraform/checks/resource/gcp/example_CloudSqlMajorVersion/main.tf
+++ b/tests/terraform/checks/resource/gcp/example_CloudSqlMajorVersion/main.tf
@@ -154,7 +154,7 @@ resource "google_sql_database_instance" "pass2" {
 }
 
 resource "google_sql_database_instance" "fail3" {
-  database_version = "SQLSERVER_2017_STANDARD"
+  database_version = "SQLSERVER_2019_STANDARD"
   name             = "general-sqlserver12"
   project          = "gcp-bridgecrew-deployment"
   region           = "us-central1"
@@ -210,7 +210,7 @@ resource "google_sql_database_instance" "fail3" {
 }
 
 resource "google_sql_database_instance" "pass3" {
-  database_version = "SQLSERVER_2019_STANDARD"
+  database_version = "SQLSERVER_2022_STANDARD"
   name             = "general-sqlserver12"
   project          = "gcp-bridgecrew-deployment"
   region           = "us-central1"
Repository: common-workflow-language/cwltool

Issue:
add flag to skip some filename checks
starting with spaces


Discussion:

Resolving patch:
diff --git a/cwltool/draft2tool.py b/cwltool/draft2tool.py
--- a/cwltool/draft2tool.py
+++ b/cwltool/draft2tool.py
@@ -25,7 +25,9 @@
 from .job import CommandLineJob
 from .stdfsaccess import StdFsAccess
 
-ACCEPTLIST_RE = re.compile(r"^[a-zA-Z0-9._+-]+$")
+ACCEPTLIST_EN_STRICT_RE = re.compile(r"^[a-zA-Z0-9._+-]+$")
+ACCEPTLIST_EN_RELAXED_RE = re.compile(r"^[ a-zA-Z0-9._+-]+$")  # with spaces
+ACCEPTLIST_RE = ACCEPTLIST_EN_STRICT_RE
 
 from .flatten import flatten
 
diff --git a/cwltool/main.py b/cwltool/main.py
--- a/cwltool/main.py
+++ b/cwltool/main.py
@@ -178,6 +178,9 @@ def arg_parser():  # type: () -> argparse.ArgumentParser
                         help="Do not compute checksum of contents while collecting outputs",
                         dest="compute_checksum")
 
+    parser.add_argument("--relax-path-checks", action="store_true",
+            default=False, help="Relax requirements on path names. Currently "
+            "allows spaces.", dest="relax_path_checks")
     parser.add_argument("workflow", type=Text, nargs="?", default=None)
     parser.add_argument("job_order", nargs=argparse.REMAINDER)
 
@@ -616,6 +619,8 @@ def main(argsl=None,
                 _logger.error("")
                 _logger.error("CWL document required, try --help for details")
                 return 1
+        if args.relax_path_checks:
+            draft2tool.ACCEPTLIST_RE = draft2tool.ACCEPTLIST_EN_RELAXED_RE
 
         try:
             document_loader, workflowobj, uri = fetch_document(args.workflow, resolver=tool_resolver)


Test patch:
diff --git a/tests/test_relax_path_checks.py b/tests/test_relax_path_checks.py
new file mode 100644
--- /dev/null
+++ b/tests/test_relax_path_checks.py
@@ -0,0 +1,39 @@
+import unittest
+from tempfile import NamedTemporaryFile
+from cwltool.main import main
+
+
+class ToolArgparse(unittest.TestCase):
+
+
+    script='''
+#!/usr/bin/env cwl-runner
+cwlVersion: v1.0
+class: CommandLineTool
+inputs:
+  - id: input
+    type: File
+    inputBinding:
+      position: 0
+outputs:
+  - id: output
+    type: File
+    outputBinding:
+      glob: test.txt
+stdout: test.txt
+baseCommand: [cat]
+'''
+
+    def test_spaces_in_input_files(self):
+        with NamedTemporaryFile() as f:
+            f.write(self.script)
+            f.flush()
+            with NamedTemporaryFile(prefix="test with spaces") as spaces:
+                self.assertEquals(
+                    main(["--debug", f.name, '--input', spaces.name]), 1)
+                self.assertEquals(
+                    main(["--debug", "--relax-path-checks", f.name, '--input',
+                        spaces.name]), 0)
+
+if __name__ == '__main__':
+    unittest.main()
Repository: common-workflow-language/cwltool

Issue:
import inside hints doesn't work
But it does work with `requirements`!

minimal.cwl
```
#!/usr/bin/env cwl-runner

cwlVersion: v1.0
class: CommandLineTool

hints:
- $import: envvar-global.yml

inputs: []
outputs: []
baseCommand: [echo]
```
```
/home/michael/workflows/env/bin/cwltool 1.0.20161113151412
Resolved 'minimal.cwl' to 'file:///home/michael/workflows/tools/minimal.cwl'
Tool definition failed validation:
Validating hint `EnvVarRequirement`: EnvVarRequirement record could not validate field `id` because it is not recognized and strict is True, valid fields are: class, envDef
could not validate field `name` because it is not recognized and strict is True, valid fields are: class, envDef
```


Discussion:

Resolving patch:
diff --git a/cwltool/process.py b/cwltool/process.py
--- a/cwltool/process.py
+++ b/cwltool/process.py
@@ -555,8 +555,11 @@ def validate_hints(self, avsc_names, hints, strict):
         for r in hints:
             try:
                 if avsc_names.get_name(r["class"], "") is not None:
-                    validate.validate_ex(avsc_names.get_name(r["class"], ""),
-                            r, strict=strict)
+                    plain_hint = dict((key,r[key]) for key in r if key not in
+                            self.doc_loader.identifiers)  # strip identifiers
+                    validate.validate_ex(
+                        avsc_names.get_name(plain_hint["class"], ""),
+                        plain_hint, strict=strict)
                 else:
                     _logger.info(Text(validate.ValidationException(
                         u"Unknown hint %s" % (r["class"]))))


Test patch:
Repository: common-workflow-language/cwltool

Issue:
boolean without prefix should not add anything to the command line
thanks to @milos-ljubinkovic for finding this!


Discussion:

Resolving patch:
diff --git a/cwltool/builder.py b/cwltool/builder.py
--- a/cwltool/builder.py
+++ b/cwltool/builder.py
@@ -230,7 +230,7 @@ def generate_arg(self, binding):  # type: (Dict[Text,Any]) -> List[Text]
             return [prefix] if prefix else []
         elif value is True and prefix:
             return [prefix]
-        elif value is False or value is None:
+        elif value is False or value is None or (value is True and not prefix):
             return []
         else:
             l = [value]
@@ -251,7 +251,8 @@ def do_eval(self, ex, context=None, pull_image=True, recursive=False):
                 return {k: self.do_eval(v, context, pull_image, recursive) for k, v in iteritems(ex)}
             if isinstance(ex, list):
                 return [self.do_eval(v, context, pull_image, recursive) for v in ex]
-
+        if context is None and type(ex) is str and "self" in ex:
+            return None
         return expression.do_eval(ex, self.job, self.requirements,
                                   self.outdir, self.tmpdir,
                                   self.resources,


Test patch:
Repository: common-workflow-language/cwltool

Issue:
Doesn't delete temporary directories after Workflow execution
## Expected Behavior
After execution of a Workflow, all of the temporary folders should be deleted

## Actual Behavior
When running Workflow (not CommandLineTool) after calling  
**[builder = self._init_job(job_order, **kwargs)](https://github.com/common-workflow-language/cwltool/blob/0866dad3d0da045668471da032d278a9ddbc9b56/cwltool/workflow.py#L556)** 
the following temporary directories are created
**[builder.outdir
builder. tmpdir
builder.stagedir](https://github.com/common-workflow-language/cwltool/blob/0866dad3d0da045668471da032d278a9ddbc9b56/cwltool/process.py#L610)** 
but only 
**[builder.outdir](https://github.com/common-workflow-language/cwltool/blob/0866dad3d0da045668471da032d278a9ddbc9b56/cwltool/main.py#L314)**  
 is deleted after Workflow execution. Which causes huge amount of empty folder in `/tmp`

## Your Environment
* cwltool version: 1.0.20180130110340




Discussion:

Resolving patch:
diff --git a/cwltool/process.py b/cwltool/process.py
--- a/cwltool/process.py
+++ b/cwltool/process.py
@@ -608,8 +608,9 @@ def _init_job(self, joborder, **kwargs):
             builder.stagedir = builder.fs_access.docker_compatible_realpath(kwargs.get("docker_stagedir") or "/var/lib/cwl")
         else:
             builder.outdir = builder.fs_access.realpath(kwargs.get("outdir") or tempfile.mkdtemp())
-            builder.tmpdir = builder.fs_access.realpath(kwargs.get("tmpdir") or tempfile.mkdtemp())
-            builder.stagedir = builder.fs_access.realpath(kwargs.get("stagedir") or tempfile.mkdtemp())
+            if self.tool[u"class"] != 'Workflow':
+                builder.tmpdir = builder.fs_access.realpath(kwargs.get("tmpdir") or tempfile.mkdtemp())
+                builder.stagedir = builder.fs_access.realpath(kwargs.get("stagedir") or tempfile.mkdtemp())
 
         if self.formatgraph:
             for i in self.tool["inputs"]:


Test patch:
Repository: common-workflow-language/cwltool

Issue:
Any[] is incompatible with any array type apart from Any[]
With the workflow:
```
cwlVersion: v1.0
class: Workflow

inputs:
  input:
    type: Any[]

steps: []

outputs:
  - id: output
    type: string[]
    outputSource: input
```
`cwltool --validate` reports the error:
```
/usr/local/bin/cwltool 1.0.20180130110340
Resolved 'workflows/test_workflow.cwl' to 'file:///Users/th10/checkouts/arvados-pipeline/arvados-pipelines/cwl/workflows/test_workflow.cwl'
Tool definition failed validation:
workflows/test_workflow.cwl:6:5: Source 'input' of type {"type": "array", "items": "Any"} is incompatible
workflows/test_workflow.cwl:12:5:   with sink 'output' of type {"type": "array", "items": "string"}
```

Any is supposed to be compatible with any other type, so Any[] should be compatible with any other array type - this is not the case.

## Your Environment
* cwltool version: 1.0.20180130110340



Discussion:
Yep, that's a bug, thanks for the report!

Resolving patch:
diff --git a/cwltool/workflow.py b/cwltool/workflow.py
--- a/cwltool/workflow.py
+++ b/cwltool/workflow.py
@@ -145,7 +145,7 @@ def can_assign_src_to_sink(src, sink, strict=False):  # type: (Any, Any, bool) -
     In strict comparison, all source types must match at least one sink type.
     """
 
-    if sink == "Any":
+    if src == "Any" or sink == "Any":
         return True
     if isinstance(src, dict) and isinstance(sink, dict):
         if src["type"] == "array" and sink["type"] == "array":


Test patch:
Repository: common-workflow-language/cwltool

Issue:
Second expression in concatenated valueFrom is ignored
In the CommandLineTool:
```yaml
cwlVersion: v1.0
requirements:
  - class: InlineJavascriptRequirement
inputs:
  - id: parameter
    inputBinding:
      valueFrom: $("a ")$("string")
    type: string?
outputs: []
class: CommandLineTool
baseCommand: echo
```

The expression `$("a ")` is ignored on when this is run:

```
/usr/local/bin/cwltool 1.0.20180130110340
Resolved 'test.cwl' to 'file:///Users/th10/checkouts/arvados-pipeline/arvados-pipelines/cwl/test.cwl'
[job test.cwl] /private/var/folders/5p/p6z8hhy174q_ctt3pn7mx5_c000h1t/T/tmp8fqrl6ng$ echo \
    string
string
[job test.cwl] completed success
{}
Final process status is success
```

CWL version: 1.0.20180130110340


Discussion:

Resolving patch:
diff --git a/cwltool/expression.py b/cwltool/expression.py
--- a/cwltool/expression.py
+++ b/cwltool/expression.py
@@ -185,7 +185,7 @@ def interpolate(scan, rootvars,
             e = evaluator(scan[w[0] + 1:w[1]], jslib, rootvars, fullJS=fullJS,
                           timeout=timeout, force_docker_pull=force_docker_pull,
                           debug=debug, js_console=js_console)
-            if w[0] == 0 and w[1] == len(scan):
+            if w[0] == 0 and w[1] == len(scan) and len(parts) <= 1:
                 return e
             leaf = json.dumps(e, sort_keys=True)
             if leaf[0] == '"':


Test patch:
diff --git a/tests/test_js_sandbox.py b/tests/test_js_sandbox.py
--- a/tests/test_js_sandbox.py
+++ b/tests/test_js_sandbox.py
@@ -1,10 +1,15 @@
 from __future__ import absolute_import
+
 import unittest
 
+from mock import Mock
+
+import cwltool
+import cwltool.factory
 # we should modify the subprocess imported from cwltool.sandboxjs
 from cwltool.sandboxjs import (check_js_threshold_version,
-                               minimum_node_version_str, subprocess)
-from mock import Mock, patch
+                               subprocess)
+from tests.util import get_data
 
 
 class Javascript_Sanity_Checks(unittest.TestCase):
@@ -33,3 +38,11 @@ def test_node_version(self):
 
     def test_is_javascript_installed(self):
             pass
+
+
+class TestValueFrom(unittest.TestCase):
+
+    def test_value_from_two_concatenated_expressions(self):
+        f = cwltool.factory.Factory()
+        echo = f.make(get_data("tests/wf/vf-concat.cwl"))
+        self.assertEqual(echo(), {u"out": u"a sting\n"})
diff --git a/tests/wf/vf-concat.cwl b/tests/wf/vf-concat.cwl
new file mode 100644
--- /dev/null
+++ b/tests/wf/vf-concat.cwl
@@ -0,0 +1,19 @@
+cwlVersion: v1.0
+class: CommandLineTool
+requirements:
+  - class: InlineJavascriptRequirement
+
+baseCommand: echo
+inputs:
+  - id: parameter
+    type: string?
+    inputBinding:
+      valueFrom: $("a ")$("sting")
+outputs:
+  out:
+    type: string
+    outputBinding:
+      glob: output.txt
+      loadContents: true
+      outputEval: $(self[0].contents)
+stdout: output.txt