Repository: tfsec/tfsec
Pull request #752 (2021-05-23 11:29:07)

add in ignore-warnings flag
solves https://github.com/tfsec/tfsec/issues/739

Added also basic unit tests for `main.go`. This requires further improvements and we should move most of the functions used in `main.go` to new module that is covered by unit tests.


Patch:
diff --git a/cmd/tfsec/main.go b/cmd/tfsec/main.go
index 383dc2f96..66dec9951 100644
--- a/cmd/tfsec/main.go
+++ b/cmd/tfsec/main.go
@@ -41,6 +41,7 @@ var excludeDownloaded = false
 var detailedExitCode = false
 var includePassed = false
 var includeIgnored = false
+var ignoreWarnings = false
 var allDirs = false
 var runStatistics bool
 
@@ -64,6 +65,7 @@ func init() {
 	rootCmd.Flags().BoolVar(&includeIgnored, "include-ignored", includeIgnored, "Include ignored checks in the result output")
 	rootCmd.Flags().BoolVar(&allDirs, "force-all-dirs", allDirs, "Don't search for tf files, include everything below provided directory.")
 	rootCmd.Flags().BoolVar(&runStatistics, "run-statistics", runStatistics, "View statistics table of current findings.")
+	rootCmd.Flags().BoolVar(&ignoreWarnings, "ignore-warnings", ignoreWarnings, "Don't show warnings in the output.")
 }
 
 func main() {
@@ -182,7 +184,7 @@ var rootCmd = &cobra.Command{
 		debug.Log("Starting scanner...")
 		results := scanner.New().Scan(blocks, mergeWithoutDuplicates(excludedChecksList, tfsecConfig.ExcludedChecks), getScannerOptions()...)
 		results = updateResultSeverity(results)
-		results = removeDuplicatesAndUnwanted(results)
+		results = RemoveDuplicatesAndUnwanted(results, ignoreWarnings, excludeDownloaded)
 		if len(filterResultsList) > 0 {
 			var filteredResult []scanner.Result
 			for _, result := range results {
@@ -254,7 +256,7 @@ func getDetailedExitCode(results []scanner.Result) int {
 	return 1
 }
 
-func removeDuplicatesAndUnwanted(results []scanner.Result) []scanner.Result {
+func RemoveDuplicatesAndUnwanted(results []scanner.Result, ignoreWarnings bool, excludeDownloaded bool) []scanner.Result {
 	reduction := map[scanner.Result]bool{}
 
 	for _, result := range results {
@@ -266,6 +268,10 @@ func removeDuplicatesAndUnwanted(results []scanner.Result) []scanner.Result {
 		if excludeDownloaded && strings.Contains(r.Range.Filename, "/.terraform") {
 			continue
 		}
+
+		if ignoreWarnings && r.Severity == scanner.SeverityWarning {
+			continue
+		}
 		returnVal = append(returnVal, r)
 	}
 	return returnVal


Test patch:
diff --git a/cmd/tfsec/main_test.go b/cmd/tfsec/main_test.go
new file mode 100644
index 000000000..a21f2ac92
--- /dev/null
+++ b/cmd/tfsec/main_test.go
@@ -0,0 +1,37 @@
+package main
+
+import (
+	"github.com/stretchr/testify/assert"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+	"testing"
+)
+
+func Test_IfIgnoreWarningsSetShouldRemoveWarningScanResults(t *testing.T) {
+	expectedResultsAfterFiltering := 1
+	twoScanResultsWithOneWarning := []scanner.Result {
+		{
+			Severity: scanner.SeverityError,
+		},
+		{
+			Severity: scanner.SeverityWarning,
+		},
+	}
+
+	actualResults := RemoveDuplicatesAndUnwanted(twoScanResultsWithOneWarning, true, false)
+	assert.Len(t, actualResults, expectedResultsAfterFiltering)
+}
+
+func Test_IfIgnoreWarningsIsNotSetThenWarningShouldBeInScanResults(t *testing.T) {
+	expectedResultsAfterFiltering := 2
+	twoScanResultsWithOneWarning := []scanner.Result {
+		{
+			Severity: scanner.SeverityError,
+		},
+		{
+			Severity: scanner.SeverityWarning,
+		},
+	}
+
+	actualResults := RemoveDuplicatesAndUnwanted(twoScanResultsWithOneWarning, false, false)
+	assert.Len(t, actualResults, expectedResultsAfterFiltering)
+}