From 5695eb22dfed672eafacb64a71da8e9bdfbaab87 Mon Sep 17 00:00:00 2001 From: Nikita Pivkin Date: Tue, 4 Feb 2025 16:44:39 +0600 Subject: [PATCH] fix(misconf): do not log scanners when misconfig scanning is disabled (#8345) Signed-off-by: nikpivkin --- pkg/commands/artifact/run.go | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/pkg/commands/artifact/run.go b/pkg/commands/artifact/run.go index 80d2f77710ee..0ce768bb944e 100644 --- a/pkg/commands/artifact/run.go +++ b/pkg/commands/artifact/run.go @@ -418,7 +418,6 @@ func disabledAnalyzers(opts flag.Options) []analyzer.Type { // Specified analyzers to be disabled depending on scanning modes // e.g. The 'image' subcommand should disable the lock file scanning. analyzers := opts.DisabledAnalyzers - // It doesn't analyze apk commands by default. if !opts.ScanRemovedPkgs { analyzers = append(analyzers, analyzer.TypeApkCommand) @@ -434,18 +433,16 @@ func disabledAnalyzers(opts flag.Options) []analyzer.Type { analyzers = append(analyzers, analyzer.TypeSecret) } - // Filter only enabled misconfiguration scanners - ma, err := filterMisconfigAnalyzers(opts.MisconfigScanners, analyzer.TypeConfigFiles) - if err != nil { - log.Error("Invalid misconfiguration scanners specified, defaulting to use all misconfig scanners", - log.Any("scanners", opts.MisconfigScanners)) - } else { - analyzers = append(analyzers, ma...) - } - // Do not perform misconfiguration scanning when it is not specified. if !opts.Scanners.AnyEnabled(types.MisconfigScanner, types.RBACScanner) { analyzers = append(analyzers, analyzer.TypeConfigFiles...) + } else { + // Filter only enabled misconfiguration scanners + ma := disabledMisconfigAnalyzers(opts.MisconfigScanners) + analyzers = append(analyzers, ma...) + + log.Debug("Enabling misconfiguration scanners", + log.Any("scanners", lo.Without(analyzer.TypeConfigFiles, ma...))) } // Scanning file headers and license files is expensive. @@ -482,14 +479,17 @@ func disabledAnalyzers(opts flag.Options) []analyzer.Type { return analyzers } -func filterMisconfigAnalyzers(included, all []analyzer.Type) ([]analyzer.Type, error) { - _, missing := lo.Difference(all, included) +func disabledMisconfigAnalyzers(included []analyzer.Type) []analyzer.Type { + _, missing := lo.Difference(analyzer.TypeConfigFiles, included) if len(missing) > 0 { - return nil, xerrors.Errorf("invalid misconfiguration scanner specified %s valid scanners: %s", missing, all) + log.Error( + "Invalid misconfiguration scanners provided, using default scanners", + log.Any("invalid_scanners", missing), log.Any("default_scanners", analyzer.TypeConfigFiles), + ) + return nil } - log.Debug("Enabling misconfiguration scanners", log.Any("scanners", included)) - return lo.Without(all, included...), nil + return lo.Without(analyzer.TypeConfigFiles, included...) } func (r *runner) initScannerConfig(ctx context.Context, opts flag.Options) (ScannerConfig, types.ScanOptions, error) {