internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: bridgecrewio/checkov

Issue:
Dockerfile scan fails when in directory and used -f
**Describe the bug**
When running directory scan checkov shows Dockerfile failed checks. When scanning file no errors are shown.

**To Reproduce**
Create Dockerfile in directory `test` with content:
```
FROM debian:buster

ENV CHECKOV_VERSION 1.0.775

RUN export DEBIAN_FRONTEND=noninteractive && \
  apt-get -y update && \
  apt-get -y --no-install-recommends install wget unzip ca-certificates git python3 python3-pip python3-setuptools python3-wheel && \
  pip3 install -U checkov=="${CHECKOV_VERSION}"
```

`checkov -f test/Dockerfile` won't show errors
`checkov -d test` will show error

**Expected behavior**
Show error in both cases.

**Screenshots**
<img width="892" alt="Screenshot 2021-04-10 at 09 39 21" src="https://user-images.githubusercontent.com/672767/114262507-a54dde80-99e0-11eb-9e9e-3e3f5d2d2a7f.png">

**Desktop (please complete the following information):**
 - OS: MacOS 11.2.3
 - Python: 3.9.4
 - Checkov Version 2.0.27



Discussion:

Resolving patch:
diff --git a/checkov/dockerfile/runner.py b/checkov/dockerfile/runner.py
--- a/checkov/dockerfile/runner.py
+++ b/checkov/dockerfile/runner.py
@@ -15,7 +15,7 @@
 class Runner(BaseRunner):
     check_type = "dockerfile"
 
-    def run(self, root_folder, external_checks_dir=None, files=None, runner_filter=RunnerFilter(),
+    def run(self, root_folder=None, external_checks_dir=None, files=None, runner_filter=RunnerFilter(),
             collect_skip_comments=True):
         report = Report(self.check_type)
         definitions = {}
@@ -28,7 +28,7 @@ def run(self, root_folder, external_checks_dir=None, files=None, runner_filter=R
 
         if files:
             for file in files:
-                if file in DOCKER_FILE_MASK:
+                if os.path.basename(file) in DOCKER_FILE_MASK:
                     (definitions[file], definitions_raw[file]) = parse(file)
 
         if root_folder:


Test patch:
diff --git a/tests/dockerfile/test_runner.py b/tests/dockerfile/test_runner.py
--- a/tests/dockerfile/test_runner.py
+++ b/tests/dockerfile/test_runner.py
@@ -32,6 +32,21 @@ def test_runner_failing_check(self):
         self.assertEqual(report.skipped_checks, [])
         report.print_console()
 
+    def test_runner_failing_check_with_file_path(self):
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+        valid_file_path = current_dir + "/resources/expose_port/fail/Dockerfile"
+        runner = Runner()
+        report = runner.run(
+            files=[valid_file_path],
+            external_checks_dir=None,
+            runner_filter=RunnerFilter(framework="all", checks=["CKV_DOCKER_1"]),
+        )
+        self.assertEqual(len(report.failed_checks), 1)
+        self.assertEqual(report.parsing_errors, [])
+        self.assertEqual(report.passed_checks, [])
+        self.assertEqual(report.skipped_checks, [])
+        report.print_console()
+
     def test_runner_passing_check(self):
         current_dir = os.path.dirname(os.path.realpath(__file__))
         valid_dir_path = current_dir + "/resources/expose_port/pass"
Repository: bridgecrewio/checkov

Issue:
CKV_AWS_119 - DynamoDB table encryption
**Describe the bug**
In general DynamoDB tables are encrypted by default and this can't be turned off, you can change it to use a KMS key of your choice. Therefore the check description is incorrect.

Further infos can be found in the API documentation https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_SSESpecification.html




Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/DynamoDBTablesEncrypted.py b/checkov/terraform/checks/resource/aws/DynamoDBTablesEncrypted.py
--- a/checkov/terraform/checks/resource/aws/DynamoDBTablesEncrypted.py
+++ b/checkov/terraform/checks/resource/aws/DynamoDBTablesEncrypted.py
@@ -4,10 +4,10 @@
 
 class DynamoDBTablesEncrypted(BaseResourceValueCheck):
     def __init__(self):
-        name = "Ensure DynamoDB Tables are encrypted"
+        name = "Ensure DynamoDB Tables are encrypted using KMS"
         id = "CKV_AWS_119"
-        supported_resources = ['aws_dynamodb_table']
-        categories = [CheckCategories.NETWORKING]
+        supported_resources = ["aws_dynamodb_table"]
+        categories = [CheckCategories.ENCRYPTION]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
     def get_inspected_key(self):


Test patch:
Repository: bridgecrewio/checkov

Issue:
boto3 is fixed at the patch level version
**Is your feature request related to a problem? Please describe.**
free boto3 dependency patch version.

**Describe the solution you'd like**
replace the line here:
https://github.com/bridgecrewio/checkov/blob/master/Pipfile#L29

with 
```
boto3 = "==1.17.*"
```
**Describe alternatives you've considered**
there are no alternatives as the patch version i don't see why is locked.
it can cause conflicts with already installed boto3 library 

**Additional context**


boto3 dependency install latest patch version
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Fixes #1211 



Discussion:
Would love a PR on it. tnx @Raffaello !
@Raffaello I believe we'll also need to update https://github.com/bridgecrewio/checkov/blob/master/setup.py for the package to be updated
I see UTs are failing on pipenv install. I'll have a go at this. Thanks for the effort @Raffaello !

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -41,7 +41,7 @@
         "junit-xml",
         "dpath>=1.5.0,<2",
         "pyyaml>=5.4.1",
-        "boto3==1.17.27",
+        "boto3==1.17.*",
         "GitPython",
         "six==1.15.0",
         "jmespath",


Test patch:
Repository: bridgecrewio/checkov

Issue:
The junitxml output is missing the `guide` links
**Describe the bug**
The junitxml output is missing the `guide` section. The output consists of, for example:

```
	<testsuite disabled="0" errors="0" failures="0" name="CKV_AZURE_14/Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service" package="checkov.terraform.checks.resource.azure.AppServiceHTTPSOnly" skipped="0" tests="2" time="0">
		<testcase classname="checkov.terraform.checks.resource.azure.AppServiceHTTPSOnly" file="plan.json" name="None CKV_AZURE_14/Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service azurerm_app_service.appservice"/>
	</testsuite>
```
It provides needed data, but it is missing a link to the guide. The issue was found when we tried to publish results in the Azure DevOps pipeline and saw there were no links to the solution.

**To Reproduce**
Steps to reproduce the behavior:
1. docker pull bridgecrew/checkov:2
2. docker run --tty --volume dir:/dir bridgecrew/checkov -f /dir/plan.json --output junitxml > dir/report.xml

**Expected behavior**
Links to the solution should be visible in Azure pipelines published results. 

**Desktop:**
 - OS: [ubuntu-20.04]
 - Checkov Version [2.0.240]




Discussion:

Resolving patch:
diff --git a/checkov/common/output/report.py b/checkov/common/output/report.py
--- a/checkov/common/output/report.py
+++ b/checkov/common/output/report.py
@@ -175,13 +175,13 @@ def get_test_suites(self) -> List[TestSuite]:
             if record.check_result['result'] == CheckResult.FAILED:
                 if record.file_path and record.file_line_range:
                     test_case.add_failure_info(
-                        f'Resource {record.resource} failed in check {check_name} - {record.file_path}:{record.file_line_range}')
+                        f'Resource {record.resource} failed in check {check_name} - {record.file_path}:{record.file_line_range} - Guideline: {record.guideline}')
                 else:
                     test_case.add_failure_info(
                         f'Resource {record.resource} failed in check {check_name}')
             if record.check_result['result'] == CheckResult.SKIPPED:
                 test_case.add_skipped_info(
-                    f'Resource {record.resource} skipped in check {check_name} \n Suppress comment: {record.check_result["suppress_comment"]}')
+                    f'Resource {record.resource} skipped in check {check_name} \n Suppress comment: {record.check_result["suppress_comment"]} - Guideline: {record.guideline}')
 
             test_cases[check_name].append(test_case)
         for key in test_cases.keys():


Test patch:
Repository: bridgecrewio/checkov

Issue:
checkov fails with junit-xml==1.8
**Describe the bug**
checkov fails with junit-xml==1.8

**To Reproduce**
Steps to reproduce the behavior:
1. pip3 install junit-xml==1.8
2. checkov -d .
3. See error: 

```
Traceback (most recent call last):
  File "/usr/local/bin/checkov", line 2, in <module>
    from checkov.main import run
  File "/opt/rh/rh-python38/root/usr/local/lib/python3.8/site-packages/checkov/main.py", line 12, in <module>
    from checkov.arm.runner import Runner as arm_runner
  File "/opt/rh/rh-python38/root/usr/local/lib/python3.8/site-packages/checkov/arm/runner.py", line 7, in <module>
    from checkov.common.output.report import Report
  File "/opt/rh/rh-python38/root/usr/local/lib/python3.8/site-packages/checkov/common/output/report.py", line 5, in <module>
    from junit_xml import TestCase, TestSuite, to_xml_report_string
ImportError: cannot import name 'to_xml_report_string' from 'junit_xml' (/opt/rh/rh-python38/root/usr/local/lib/python3.8/site-packages/junit_xml/__init__.py)
```

**Expected behavior**
checkov runs fine with junit-xml==1.9 so a reasonable fix would be to pin that version (or greater) in setup.py install_requires.

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Desktop (please complete the following information):**
 - OS: RHEL 7
 - Checkov Version [e.g. 22]: 2.0.350

**Additional context**
Add any other context about the problem here (e.g. code snippets).



Discussion:

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -39,7 +39,7 @@
         "tabulate",
         "colorama",
         "termcolor",
-        "junit-xml",
+        "junit-xml>=1.9",
         "dpath>=1.5.0,<2",
         "pyyaml>=5.4.1",
         "boto3==1.17.*",


Test patch:
Repository: bridgecrewio/checkov

Issue:
Fix for #1521 (GH CodeQL Upload Sarif) contains a bug
As it turns out, my fix for this issue contains a bug: 
![image](https://user-images.githubusercontent.com/21954788/132401167-31f085d3-7fa5-45e1-b803-a6ab7a1bbebd.png)
As the screenshot indicates, the cause is https://github.com/bridgecrewio/checkov/blob/507340f8bc7e9d9b58263c9a66bbdd05752dae3a/checkov/common/output/report.py#L212 The call to rules.index(rule) is searching for the current rule object in the rules array, but no such object will exist whenever the values of record.check_id are the same. There will, however, be another rule object in the array with the same id.

I'm opening a PR, which I'll link to this issue, which resolves the error by comparing the value of rule['id'] with each rule in the array until it finds the index of the rule with the matching id. Apologies for letting this slip past me in the first place!

_Originally posted by @harringj in https://github.com/bridgecrewio/checkov/issues/1521#issuecomment-914581519_


Discussion:

Resolving patch:
diff --git a/checkov/common/output/report.py b/checkov/common/output/report.py
--- a/checkov/common/output/report.py
+++ b/checkov/common/output/report.py
@@ -209,7 +209,10 @@ def get_sarif_json(self) -> Dict[str, Any]:
                 ruleset.add(record.check_id)
                 rules.append(rule)
             else:
-                idx = rules.index(rule)
+                for r in rules:
+                    if r['id'] == rule['id']:
+                        idx = rules.index(r)
+                        break
             if record.file_line_range[0] == 0:
                 record.file_line_range[0] = 1
             if record.file_line_range[1] == 0:


Test patch:
diff --git a/tests/common/output/__init__.py b/tests/common/output/__init__.py
new file mode 100644
Repository: bridgecrewio/checkov

Issue:
Bug: file preview not working with SARIF results uploaded from Checkov to Github
Being able to view the code responsible for a security alert in Github's code scanning feature is crucial for developers. The file preview provides important contextual information for devs that helps them arrive at a fix without a lot of context switching.

Other tools, like CodeQL and tfsec, currently display file previews in code scanning without issue. The individual result view for Checkov, however, currently looks like this. 

![image](https://user-images.githubusercontent.com/21954788/132904065-3bce96cd-69a6-4db7-8f5a-012a74d18fb1.png)

Note the odd double slash in front of the filename. My hunch is that the double slash is preventing code scanning's rendering engine from displaying a file preview because, in this example, //backend.tf is not a valid filepath, as it needs to be per https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#physicallocation-object.

The bug seems to be affecting the individual result view specifically, since the list view does have a valid filepath, as can be seen here:

![image](https://user-images.githubusercontent.com/21954788/132904002-a8418ec0-36fd-4267-b8d8-f7b59dec0f95.png)

I don't know Checkov's codebase well enough to suggest a fix -- and it looks like Bridgecrew is committed to absolute URIs, which may make a fix trickier -- but `record.file_path` is somehow ending up with an additional prepended slash it shouldn't have:

https://github.com/bridgecrewio/checkov/blob/a217a1a04d92ed0ca6456ed5e3e13f4403f0eef1/checkov/common/output/report.py#L230


Discussion:
Hey @harringj !

Yes, we prepend `/` to all the paths in the record I believe. If sarif needs it without the `/` - we're open to a contribution removing this `/` specifically for sarif. The snippet you put in the issue seems like the right place to me :)

Resolving patch:
diff --git a/checkov/common/output/report.py b/checkov/common/output/report.py
--- a/checkov/common/output/report.py
+++ b/checkov/common/output/report.py
@@ -227,7 +227,7 @@ def get_sarif_json(self) -> Dict[str, Any]:
                 "locations": [
                     {
                         "physicalLocation": {
-                            "artifactLocation": {"uri": record.file_path},
+                            "artifactLocation": {"uri": record.file_path.lstrip("/")},
                             "region": {
                                 "startLine": int(record.file_line_range[0]),
                                 "endLine": int(record.file_line_range[1]),


Test patch:
Repository: bridgecrewio/checkov

Issue:
Ability to disable the ASCII art logo to make app more automation friendly
**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

When running checkov as part of automation and process tooling such as pre-commit, the many lines of ASCII art overwhelm the meaningful output of the checks themselves (what passed and what failed).

**Describe the solution you'd like**
Make the '--quiet' option (or another explicit option) disable the output of the logo, we already know what the name of the tool being executed is.  Anything to reduce the amount of superfluous lines of text in automation outputs will help the community track down actual issues.

**Describe alternatives you've considered**
Looked at various different output formats when run in CI/CD such as JUnit or the like, but none of those outputs are developer friendly when run using pre-commit or other CLI tools during development.



Discussion:
Hey @gwvandesteeg !

I do believe the JSON output does not include the ASCII art. Will that work for you?
> Hey @gwvandesteeg !
> 
> I do believe the JSON output does not include the ASCII art. Will that work for you?

Not really, JSON output is not human friendly without post-processing, and doesn't really suit for local development.  I think I've gotten around it with pre-commit if there are no issues, but would still like to be able to do this when there are issues so that they can be actioned.
Hey! Could I work on this? I think that a `--quiet` or a `--no-art` flag would be a great addition to the tool.

Resolving patch:
diff --git a/checkov/common/runners/runner_registry.py b/checkov/common/runners/runner_registry.py
--- a/checkov/common/runners/runner_registry.py
+++ b/checkov/common/runners/runner_registry.py
@@ -79,7 +79,7 @@ def print_reports(
     ) -> Literal[0, 1]:
         output_formats = set(config.output)
 
-        if "cli" in config.output:
+        if "cli" in config.output and not config.quiet:
             print(f"{self.banner}\n")
         exit_codes = []
         report_jsons = []
diff --git a/checkov/main.py b/checkov/main.py
--- a/checkov/main.py
+++ b/checkov/main.py
@@ -229,7 +229,7 @@ def run(banner=checkov_banner, argv=sys.argv[1:]):
             return
         bc_integration.commit_repository(config.branch)
         image_scanner.scan(config.docker_image, config.dockerfile_path)
-    else:
+    elif not config.quiet:
         print(f"{banner}")
 
         bc_integration.onboarding()


Test patch:
Repository: bridgecrewio/checkov

Issue:
checkov silently returns [] when an `--external-checks-dir` doesn't have an init file
**Describe the bug**
When I use `--external-checks-dir` with a directory without an `__init__.py`, all `checkov` does is output `[]` when doing --output json.


**Expected behavior**
Yell at me for giving a directory without any `__init__.py` file in it.



Discussion:
@KevinHock Nice catch. I think that we can even make checkov add this file for you. Wdyt?
Sounds great to me, thanks @schosterbarak 
I don’t think the init file is needed. Do we care about it?
I am not sure. the ability to load external dir of checks was originally contributed by @jeromepin. 
any ideas around it? 
I can test it pretty easily, but it walks files and loads non-init files directly. Pretty sure that check could be omitted. (We hit some of that while testing sub-dirs in slack a couple days ago.)
Cool!
Side Q: should all returns of `[]` be a bug? It'd kind of be nice to get the same dictionary format, regardless of what you're scanning, even if the dict says 0 findings.
@KevinHock what should be the returned value? 
I would think a dictionary with e.g. failed_checks 0, skipped_checks 0, etc.
I'd like to take up this task. So what should be the solution? Emit an error when using `--external-checks-dir` with a directory without an `__init__.py` file, or return a `Report` with `0` values?

Resolving patch:
diff --git a/checkov/common/runners/runner_registry.py b/checkov/common/runners/runner_registry.py
--- a/checkov/common/runners/runner_registry.py
+++ b/checkov/common/runners/runner_registry.py
@@ -152,7 +152,9 @@ def print_reports(
             if output_formats:
                 print(OUTPUT_DELIMITER)
         if "json" in config.output:
-            if len(report_jsons) == 1:
+            if not report_jsons:
+                print(json.dumps(Report(None).get_summary(), indent=4))
+            elif len(report_jsons) == 1:
                 print(json.dumps(report_jsons[0], indent=4))
             else:
                 print(json.dumps(report_jsons, indent=4))


Test patch:
Repository: bridgecrewio/checkov

Issue:
Bump boto3 to the latest version
**Describe the bug**
I am trying to installing checkov and the latest boto3 version within an environment. However, checkov depends on  version 1.17.* 

Could you please bump boto3 to the latest version?


Discussion:

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -42,7 +42,7 @@
         "junit-xml>=1.9",
         "dpath>=1.5.0,<2",
         "pyyaml>=5.4.1",
-        "boto3==1.17.*",
+        "boto3>=1.17",
         "GitPython",
         "jmespath",
         "tqdm",


Test patch:
Repository: bridgecrewio/checkov

Issue:
CKV_AZURE_80 - dotnet_framework_version with v6.0 fails
**Describe the issue**
Currently .NET 6.0 is the latest LTS version. However, CKV_AZURE_80 expects that latest version is v5.0.

**Examples**
```
resource "azurerm_app_service" "searchApi" {
  ...
  site_config {
    dotnet_framework_version = "v6.0"
  }
}
```
There should be no warning for CKV_AZURE_80 with the above configuration.

**Version (please complete the following information):**
 - Checkov Version 2.0.717



Discussion:
@Dunklas thanks for reporting 💪 you are totally right, since the new 6.0 version was released it a few months ago, this check should be adjusted. Do you want to try and fix it?
Sure thing! I'll look into it during the weekend :)
to make your life easier, you will need to adjust those files
https://github.com/bridgecrewio/checkov/blob/9f448d714432d3118a00a453c76dd8762aa284ab/checkov/terraform/checks/resource/azure/AppServiceDotnetFrameworkVersion.py
https://github.com/bridgecrewio/checkov/blob/9f448d714432d3118a00a453c76dd8762aa284ab/tests/terraform/checks/resource/azure/test_AppServiceDotnetFrameworkVersion.py

Resolving patch:
diff --git a/checkov/terraform/checks/resource/azure/AppServiceDotnetFrameworkVersion.py b/checkov/terraform/checks/resource/azure/AppServiceDotnetFrameworkVersion.py
--- a/checkov/terraform/checks/resource/azure/AppServiceDotnetFrameworkVersion.py
+++ b/checkov/terraform/checks/resource/azure/AppServiceDotnetFrameworkVersion.py
@@ -14,7 +14,7 @@ def get_inspected_key(self):
         return "site_config/0/dotnet_framework_version"
 
     def get_expected_value(self):
-        return "v5.0"
+        return "v6.0"
 
 
 check = AppServiceDotnetFrameworkVersion()


Test patch:
diff --git a/tests/terraform/checks/resource/azure/test_AppServiceDotnetFrameworkVersion.py b/tests/terraform/checks/resource/azure/test_AppServiceDotnetFrameworkVersion.py
--- a/tests/terraform/checks/resource/azure/test_AppServiceDotnetFrameworkVersion.py
+++ b/tests/terraform/checks/resource/azure/test_AppServiceDotnetFrameworkVersion.py
@@ -17,7 +17,7 @@ def test_failure_old_version(self):
               app_service_plan_id = azurerm_app_service_plan.example.id
               https_only          = true
               site_config {
-                dotnet_framework_version = "v4.0"
+                dotnet_framework_version = "v5.0"
                 scm_type                 = "someValue"
                 }
               }
@@ -52,7 +52,7 @@ def test_success_latest_version(self):
               app_service_plan_id = azurerm_app_service_plan.example.id
               https_only          = true
               site_config {
-                dotnet_framework_version = "v5.0"
+                dotnet_framework_version = "v6.0"
                 scm_type                 = "someValue"
                 }
               }