Repository: aquasecurity/tfsec
Pull request #1094 (2021-10-01 17:15:47)

add check for github vulnerability_alerts

CLAassistant: [![CLA assistant check](https://cla-assistant.io/pull/badge/not_signed)](https://cla-assistant.io/aquasecurity/tfsec?pullRequest=1094) <br/>Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our [Contributor License Agreement](https://cla-assistant.io/aquasecurity/tfsec?pullRequest=1094) before we can accept your contribution.<br/><sub>You have signed the CLA already but the status is still pending? Let us [recheck](https://cla-assistant.io/check/aquasecurity/tfsec?pullRequest=1094) it.</sub>

Patch:
diff --git a/internal/app/tfsec/rules/github/repositories/vulnerability_alerts_rule.go b/internal/app/tfsec/rules/github/repositories/vulnerability_alerts_rule.go
new file mode 100644
index 000000000..9d1f8cfda
--- /dev/null
+++ b/internal/app/tfsec/rules/github/repositories/vulnerability_alerts_rule.go
@@ -0,0 +1,63 @@
+package repositories
+
+// ATTENTION!
+// This rule was autogenerated!
+// Before making changes, consider updating the generator.
+
+import (
+	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
+	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
+	"github.com/aquasecurity/tfsec/pkg/provider"
+	"github.com/aquasecurity/tfsec/pkg/result"
+	"github.com/aquasecurity/tfsec/pkg/rule"
+	"github.com/aquasecurity/tfsec/pkg/severity"
+)
+
+func init() {
+	scanner.RegisterCheckRule(rule.Rule{
+		Provider:  provider.GitHubProvider,
+		Service:   "repositories",
+		ShortCode: "vulnerability-alerts",
+		Documentation: rule.RuleDocumentation{
+			Summary:     "Github vulnerability alerts should be enabled.",
+			Explanation: `You can do this by either setting <code>vulnerability_alerts</code> attribute to 'true'.`,
+			Impact:      "Insecure vulnerabilities might be used in the codebase.",
+			Resolution:  "Enable vulnerability alerts for all repositories.",
+			BadExample: []string{`
+resource "github_repository" "bad_example" {
+  name        		   = "example"
+  description 		   = "My awesome codebase"
+  vulnerability_alerts = false
+}
+`},
+			GoodExample: []string{`
+resource "github_repository" "good_example" {
+  name        		   = "example"
+  description 		   = "My awesome codebase"
+  vulnerability_alerts = true
+}
+`},
+			Links: []string{
+				"https://registry.terraform.io/providers/hashicorp/github/latest/docs/resources/repository#vulnerability_alerts",
+				"https://docs.github.com/en/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies",
+			},
+		},
+		RequiredTypes: []string{
+			"resource",
+		},
+		RequiredLabels: []string{
+			"github_repository",
+		},
+		DefaultSeverity: severity.High,
+		CheckFunc: func(set result.Set, resourceBlock block.Block, module block.Module) {
+			if vulnerabilityAlertsAttr := resourceBlock.GetAttribute("vulnerability_alerts"); vulnerabilityAlertsAttr.IsNil() { // alert on use of default value
+				set.AddResult().
+					WithDescription("Resource '%s' uses default value for vulnerability_alerts", resourceBlock.FullName())
+			} else if vulnerabilityAlertsAttr.IsFalse() {
+				set.AddResult().
+					WithDescription("Resource '%s' does not have vulnerability_alerts set to true", resourceBlock.FullName()).
+					WithAttribute(vulnerabilityAlertsAttr)
+			}
+		},
+	})
+}


Test patch:
diff --git a/internal/app/tfsec/rules/github/repositories/vulnerability_alerts_rule_test.go b/internal/app/tfsec/rules/github/repositories/vulnerability_alerts_rule_test.go
new file mode 100644
index 000000000..136f0603e
--- /dev/null
+++ b/internal/app/tfsec/rules/github/repositories/vulnerability_alerts_rule_test.go
@@ -0,0 +1,53 @@
+package repositories
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
+	"github.com/aquasecurity/tfsec/internal/app/tfsec/testutil"
+)
+
+func Test_GithubVulnerabilityAlerts_FailureExamples(t *testing.T) {
+	expectedCode := "github-repositories-vulnerability-alerts"
+
+	rule, err := scanner.GetRuleById(expectedCode)
+	if err != nil {
+		t.Fatalf("Rule not found: %s", expectedCode)
+	}
+	for i, badExample := range rule.Documentation.BadExample {
+		t.Logf("Running bad example for '%s' #%d", expectedCode, i+1)
+		if strings.TrimSpace(badExample) == "" {
+			t.Fatalf("bad example code not provided for %s", rule.ID())
+		}
+		defer func() {
+			if err := recover(); err != nil {
+				t.Fatalf("Scan (bad) failed: %s", err)
+			}
+		}()
+		results := testutil.ScanHCL(badExample, t)
+		testutil.AssertCheckCode(t, rule.ID(), "", results)
+	}
+}
+
+func Test_GithubVulnerabilityAlerts_SuccessExamples(t *testing.T) {
+	expectedCode := "github-repositories-vulnerability-alerts"
+
+	rule, err := scanner.GetRuleById(expectedCode)
+	if err != nil {
+		t.Fatalf("Rule not found: %s", expectedCode)
+	}
+	for i, example := range rule.Documentation.GoodExample {
+		t.Logf("Running good example for '%s' #%d", expectedCode, i+1)
+		if strings.TrimSpace(example) == "" {
+			t.Fatalf("good example code not provided for %s", rule.ID())
+		}
+		defer func() {
+			if err := recover(); err != nil {
+				t.Fatalf("Scan (good) failed: %s", err)
+			}
+		}()
+		results := testutil.ScanHCL(example, t)
+		testutil.AssertCheckCode(t, "", rule.ID(), results)
+	}
+}