Input parameters verification ignores assignment rules about konstraint

[stek29]

ah, it's more complicated than I thought.

parameter checking does run on imported files, it just doesn't catch things like foo = input.parameters.foo

however, checking is still broken for libraries since it expects library itself to have @parameter annotations, and not the policy importing it.

[jalseth]

Hi, I'm not sure what you mean when you say it doesn't catch things like foo = input.parameters.foo. The regex would find that.

When writing policies, I wouldn't expect any libraries to reference the parameters directly. Instead they could be functions and the main policy could pass the parameters in.

[stek29]

@jalseth the regex works on Body, which in case of test = input.parameters.test would be { true }, since test = input.parameters.test is equivalent to test = input.parameters.test { true }

[jalseth]

The regex does not evaluate the Rego. When it sees test = input.parameters.foo the parameter that is extracted is foo; it is everything after the parameters. until there is a character that doesn't match the regex [a-zA-Z0-9-_]. I'm not sure what you mean when you say it would be { true }.

[stek29]

@jalseth here's what I mean by "body would be { true }"

diff --git a/internal/rego/rego.go b/internal/rego/rego.go
index 142fdfcbb39e..9403c1a825ff 100644
--- a/internal/rego/rego.go
+++ b/internal/rego/rego.go
@@ -379,6 +379,7 @@ func getBodyParamNames(rules []*ast.Rule) []string {
        r := regexp.MustCompile(`(core|input)\.parameters\.([a-zA-Z0-9_-]+)`)
        var bodyParams []string
        for _, rule := range rules {
+               fmt.Printf("ast.Rule `%v`: Head: `%v` Body: `%v`\n", rule, rule.Head, rule.Body)
                matches := r.FindAllStringSubmatch(rule.Body.String(), -1)
                for _, match := range matches {
                        if !contains(bodyParams, match[2]) {

❯ grep -ve '^#' test/src.rego      
package test
import data.lib.libraryA
violation[{"msg": "msg"}] {
    true # some comment with a trailing space 
}

❯ cat test/lib/libraryA.rego          
package lib.libraryA
test = input.parameters.test

❯ go run . create test --output test  
ast.Rule `violation[{"msg": "msg"}] { true }`: Head: `violation[{"msg": "msg"}]` Body: `true`
ast.Rule `test = input.parameters.test { true }`: Head: `test = input.parameters.test` Body: `true`
INFO[0000] completed successfully                        num_policies=1

[stek29]

So test = input.parameters.test as ast.Rule represented in yaml would be:

head:
  name: test
  args: []
  key: nil
  value: input.parameters.test
body:
  - "true"

[stek29]

while the regex only checks rule.Body and not rule.Head.Value for use of parameters

[jalseth]

Thank you for the clarification! I think this can be fixed by combining the rule.Head.Value and rule.Body before performing the regex search.

[jalseth]

@stek29 I've implemented this in #279, I'd appreciate a quick review of the change if you have time.