Skip to content

Commit be5ec0a

Browse files
chanel-ychanel-y
authored
Merge branch 'main' into bump-2-27-0
2 parents cd6ddb7 + 603e4bc commit be5ec0a

8 files changed

Lines changed: 132 additions & 3 deletions

File tree

‎iac/ql/lib/codeql/hcl/ast/AstNodes.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -100,12 +100,12 @@ class HclAstNode extends THclAstNode {
100100
* }
101101
* ```
102102
*/
103-
class Comment extends HclAstNode, TComment {
103+
class HCLComment extends HclAstNode, TComment {
104104
private HCL::Comment comment;
105105

106-
override string getAPrimaryQlClass() { result = "Comment" }
106+
override string getAPrimaryQlClass() { result = "HCLComment" }
107107

108-
Comment() { this = TComment(comment) }
108+
HCLComment() { this = TComment(comment) }
109109

110110
/** Gets the textual contents of the comment. */
111111
string getContents() { result = comment.getValue() }

‎iac/ql/lib/codeql/iac/Comments.qll‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
/**
2+
* Provides a unified representation of comments across the infrastructure-as-code
3+
* (IaC) languages supported by CodeQL, spanning HCL/Terraform comments and comments
4+
* in YAML files recognized by a public IaC framework API.
5+
*/
6+
7+
import iac
8+
9+
/**
10+
* Holds if `file` is a YAML file recognized by a public IaC framework API.
11+
*/
12+
private predicate isSupportedYamlFile(File file) {
13+
exists(CloudFormation::Document document | document.getFile() = file)
14+
or
15+
exists(ARM::Document document | document.getFile() = file)
16+
or
17+
exists(AzurePipelines::Document document | document.getFile() = file)
18+
or
19+
exists(Compose::Document document | document.getFile() = file)
20+
or
21+
exists(HelmChart::Document document | document.getFile() = file)
22+
or
23+
exists(OpenApi::Document document | document.getFile() = file)
24+
or
25+
exists(YamlMapping document |
26+
document.getFile() = file and
27+
document
28+
.lookup("$schema")
29+
.(YamlString)
30+
.getValue()
31+
.regexpMatch(".*schema\\.management\\.azure\\.com.*")
32+
)
33+
}
34+
35+
/**
36+
* Gets the delimiter-stripped `text` and `delimiterStyle` of an HCL comment.
37+
*/
38+
private predicate getHclCommentText(HCLComment comment, string text, string delimiterStyle) {
39+
exists(string raw | raw = comment.getContents() |
40+
raw.matches("#%") and
41+
text = raw.suffix(1).replaceAll("\r", "") and
42+
delimiterStyle = "hash"
43+
or
44+
raw.matches("//%") and
45+
text = raw.suffix(2).replaceAll("\r", "") and
46+
delimiterStyle = "slash"
47+
or
48+
raw.matches("/*%*/") and
49+
text = raw.substring(2, raw.length() - 2).replaceAll("\r", "") and
50+
delimiterStyle = "slash"
51+
)
52+
}
53+
54+
/**
55+
* Gets the delimiter-stripped `text` and `delimiterStyle` of a comment exposed by a
56+
* supported public IaC API located at `location`.
57+
*/
58+
private predicate getIacCommentText(Location location, string text, string delimiterStyle) {
59+
exists(HCLComment comment |
60+
location = comment.getLocation() and
61+
getHclCommentText(comment, text, delimiterStyle)
62+
)
63+
or
64+
exists(YamlComment comment |
65+
location = comment.getLocation() and
66+
isSupportedYamlFile(comment.getLocation().getFile()) and
67+
text = comment.getText() and
68+
delimiterStyle = "hash"
69+
)
70+
}
71+
72+
/**
73+
* A comment exposed by a supported public IaC API.
74+
*
75+
* This spans HCL/Terraform comments and comments in YAML files recognized by a public
76+
* IaC framework API (for example CloudFormation, ARM, Azure Pipelines, Compose, Helm
77+
* charts and OpenAPI documents).
78+
*/
79+
class Comment extends Location {
80+
Comment() {
81+
getIacCommentText(this, _, _)
82+
}
83+
84+
/** Gets the comment text without its delimiter. */
85+
string getText() {
86+
getIacCommentText(this, result, _)
87+
}
88+
89+
/** Holds if this comment uses `#` as its delimiter. */
90+
predicate hasHashDelimiter() { getIacCommentText(this, _, "hash") }
91+
}

‎iac/ql/lib/iac.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import codeql.Locations
22
import codeql.files.FileSystem
3+
import codeql.iac.Comments
34
import codeql.iac.Dependencies
45
// Azure
56
import codeql.iac.azure.ARM

‎iac/ql/test/library-tests/comments/Comments.expected‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
iacComments
2+
| sample.hcl:1:1:1:16 | sample.hcl@1:1:1:16 |
3+
| sample.hcl:2:1:2:18 | sample.hcl@2:1:2:18 |
4+
| sample.hcl:3:1:3:21 | sample.hcl@3:1:3:21 |
5+
| sample.hcl:6:24:6:47 | sample.hcl@6:24:6:47 |
6+
| template.yml:3:3:3:28 | template.yml@3:3:3:28 |
7+
getText
8+
| sample.hcl:1:1:1:16 | sample.hcl@1:1:1:16 | a hash comment |
9+
| sample.hcl:2:1:2:18 | sample.hcl@2:1:2:18 | a slash comment |
10+
| sample.hcl:3:1:3:21 | sample.hcl@3:1:3:21 | a block comment |
11+
| sample.hcl:6:24:6:47 | sample.hcl@6:24:6:47 | an inline hash comment |
12+
| template.yml:3:3:3:28 | template.yml@3:3:3:28 | a supported YAML comment |
13+
hasHashDelimiter
14+
| sample.hcl:1:1:1:16 | sample.hcl@1:1:1:16 |
15+
| sample.hcl:6:24:6:47 | sample.hcl@6:24:6:47 |
16+
| template.yml:3:3:3:28 | template.yml@3:3:3:28 |

‎iac/ql/test/library-tests/comments/Comments.ql‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
private import iac
2+
3+
query predicate iacComments(Comment c) { any() }
4+
5+
query predicate getText(Comment c, string text) { text = c.getText() }
6+
7+
query predicate hasHashDelimiter(Comment c) { c.hasHashDelimiter() }

‎iac/ql/test/library-tests/comments/sample.hcl‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# a hash comment
2+
// a slash comment
3+
/* a block comment */
4+
5+
resource "aws_instance" "example" {
6+
ami = "ami-12345678" # an inline hash comment
7+
}

‎iac/ql/test/library-tests/comments/template.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Resources:
3+
# a supported YAML comment
4+
ExampleBucket:
5+
Type: AWS::S3::Bucket

‎iac/ql/test/library-tests/comments/unsupported.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# an unsupported YAML comment that should be ignored
2+
foo: bar

0 commit comments

Comments
 (0)