-
Notifications
You must be signed in to change notification settings - Fork 358
Labels
bugSomething isn't workingSomething isn't workingcommunityCommunity contributionCommunity contributionkubernetesKubernetes queryKubernetes queryqueryNew query featureNew query featureterraformTerraform queryTerraform query
Description
kics incorrectly detects valid labels as "Metadata Label Is Invalid"
Example:
resource "kubernetes_config_map" "gateway_class_defaults" {
metadata {
name = "gateway-class-defaults"
labels = {
"gateway.istio.io/defaults-for-class" = "something"
}
}
data = {
a = "b"
}
}Kubernetes allows a single slash: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set, which is a common pattern for labels and annotations.
The regex in kics does not: https://github.com/Checkmarx/kics/pull/2595/files#diff-613f4a5ed1b42d778d1dc4b070e5bde3cfbbd4606c24e2476ea5e95ff318f7dcR8
Expected Behavior
No error for labels with prefix
Actual Behavior
...
Metadata Label Is Invalid, Severity: LOW, Results: 3
Description: Check if any label in the metadata is invalid.
Platform: Terraform
CWE: 710
Risk Score: 3.3
Learn more about this vulnerability: https://docs.kics.io/latest/queries/terraform-queries/bc3dabb6-fd50-40f8-b9ba-7429c9f1fb0e
...
[3]: ../../data/gateway.tf:94
093:
094: labels = {
095: "gateway.istio.io/defaults-for-class" = "something"
...
Steps to Reproduce the Problem
Just scan the example above
Specifications
N/A
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't workingcommunityCommunity contributionCommunity contributionkubernetesKubernetes queryKubernetes queryqueryNew query featureNew query featureterraformTerraform queryTerraform query