secureCodeBox · J12934 · Jul 22, 2021 · Jun 24, 2021 · Jun 24, 2021 · Jun 25, 2021
diff --git a/hooks/cascading-scans/hook/hook.test.js b/hooks/cascading-scans/hook/hook.test.js
diff --git a/hooks/cascading-scans/hook/hook.ts b/hooks/cascading-scans/hook/hook.ts
@@ -9,12 +9,14 @@ import * as Mustache from "mustache";
 import {
   startSubsequentSecureCodeBoxScan,
   getCascadingRulesForScan,
-  getCascadingScanDefinition,
   // types
   Scan,
   Finding,
   CascadingRule,
-  ExtendedScanSpec
+  getCascadedRuleForScan,
+  purgeCascadedRuleFromScan,
+  mergeInheritedMap,
+  mergeInheritedArray
 } from "./scan-helpers";
 
 interface HandleArgs {
@@ -25,12 +27,12 @@ interface HandleArgs {
 export async function handle({ scan, getFindings }: HandleArgs) {
   const findings = await getFindings();
   const cascadingRules = await getCascadingRules(scan);
+  const cascadedRuleUsedForParentScan = await getCascadedRuleForScan(scan);
 
-  const cascadingScans = getCascadingScans(scan, findings, cascadingRules);
+  const cascadingScans = getCascadingScans(scan, findings, cascadingRules, cascadedRuleUsedForParentScan);
 
   for (const cascadingScan of cascadingScans) {
-    const cascadingScanDefinition = getCascadingScanDefinition(cascadingScan, scan);
-    await startSubsequentSecureCodeBoxScan(cascadingScanDefinition);
+    await startSubsequentSecureCodeBoxScan(cascadingScan);
   }
 }
 
@@ -46,11 +48,14 @@ async function getCascadingRules(scan: Scan): Promise<Array<CascadingRule>> {
 export function getCascadingScans(
   parentScan: Scan,
   findings: Array<Finding>,
-  cascadingRules: Array<CascadingRule>
-): Array<ExtendedScanSpec> {
-  let cascadingScans: Array<ExtendedScanSpec> = [];
+  cascadingRules: Array<CascadingRule>,
+  cascadedRuleUsedForParentScan: CascadingRule
+): Array<Scan> {
+  let cascadingScans: Array<Scan> = [];
   const cascadingRuleChain = getScanChain(parentScan);
 
+  parentScan = purgeCascadedRuleFromScan(parentScan, cascadedRuleUsedForParentScan);
+
   for (const cascadingRule of cascadingRules) {
     // Check if the Same CascadingRule was already applied in the Cascading Chain
     // If it has already been used skip this rule as it could potentially lead to loops
@@ -67,7 +72,7 @@ export function getCascadingScans(
   return cascadingScans;
 }
 
-function getScanChain(parentScan: Scan) {
+export function getScanChain(parentScan: Scan) {
   // Get the current Scan Chain (meaning which CascadingRules were used to start this scan and its parents) and convert it to a set, which makes it easier to query.
   if (
     parentScan.metadata.annotations &&
@@ -81,7 +86,7 @@ function getScanChain(parentScan: Scan) {
 }
 
 function getScansMatchingRule(parentScan: Scan, findings: Array<Finding>, cascadingRule: CascadingRule) {
-  const cascadingScans: Array<ExtendedScanSpec> = [];
+  const cascadingScans: Array<Scan> = [];
   for (const finding of findings) {
     // Check if one (ore more) of the CascadingRule matchers apply to the finding
     const matches = cascadingRule.spec.matches.anyOf.some(matchesRule =>
@@ -100,8 +105,79 @@ function getCascadingScan(
   finding: Finding,
   cascadingRule: CascadingRule
 ) {
-  const { scanType, parameters, env } = cascadingRule.spec.scanSpec;
+  cascadingRule = templateCascadingRule(parentScan, finding, cascadingRule);
+
+  let { scanType, parameters } = cascadingRule.spec.scanSpec;
+
+  let { annotations, labels, env, volumes, volumeMounts } = mergeCascadingRuleWithScan(parentScan, cascadingRule);
+
+  let cascadingChain: Array<string> = [];
+  if (parentScan.metadata.annotations && parentScan.metadata.annotations["cascading.securecodebox.io/chain"]) {
+    cascadingChain = parentScan.metadata.annotations[
+      "cascading.securecodebox.io/chain"
+    ].split(",");
+  }
+
+  return {
+    apiVersion: "execution.securecodebox.io/v1",
+    kind: "Scan",
+    metadata: {
+      generateName: `${generateCascadingScanName(parentScan, cascadingRule)}-`,
+      labels,
+      annotations: {
+        "securecodebox.io/hook": "cascading-scans",
+        "cascading.securecodebox.io/parent-scan": parentScan.metadata.name,
+        "cascading.securecodebox.io/matched-finding": finding.id,
+        "cascading.securecodebox.io/chain": [
+          ...cascadingChain,
+          cascadingRule.metadata.name
+        ].join(","),
+        ...annotations,
+      },
+      ownerReferences: [
+        {
+          apiVersion: "execution.securecodebox.io/v1",
+          blockOwnerDeletion: true,
+          controller: true,
+          kind: "Scan",
+          name: parentScan.metadata.name,
+          uid: parentScan.metadata.uid
+        }
+      ]
+    },
+    spec: {
+      scanType,
+      parameters,
+      cascades: parentScan.spec.cascades,
+      env,
+      volumes,
+      volumeMounts,
+    }
+  };
+}
+
+function mergeCascadingRuleWithScan(
+  scan: Scan,
+  cascadingRule: CascadingRule
+) {
+  const { scanAnnotations, scanLabels } = cascadingRule.spec;
+  let { env = [], volumes = [], volumeMounts = [] } = cascadingRule.spec.scanSpec;
+  let { inheritAnnotations, inheritLabels, inheritEnv, inheritVolumes } = scan.spec.cascades;
 
+  return {
+    annotations: mergeInheritedMap(scan.metadata.annotations, scanAnnotations, inheritAnnotations),
+    labels: mergeInheritedMap(scan.metadata.labels, scanLabels, inheritLabels),
+    env: mergeInheritedArray(scan.spec.env, env, inheritEnv),
+    volumes: mergeInheritedArray(scan.spec.volumes, volumes, inheritVolumes),
+    volumeMounts: mergeInheritedArray(scan.spec.volumeMounts, volumeMounts, inheritVolumes)
+  }
+}
+
+function templateCascadingRule(
+  parentScan: Scan,
+  finding: Finding,
+  cascadingRule: CascadingRule
+): CascadingRule {
   const templateArgs = {
     ...finding,
     ...parentScan,
@@ -112,21 +188,19 @@ function getCascadingScan(
     }
   };
 
-  return {
-    name: generateCascadingScanName(parentScan, cascadingRule),
-    scanType: Mustache.render(scanType, templateArgs),
-    parameters: parameters.map(parameter =>
-      Mustache.render(parameter, templateArgs)
-    ),
-    cascades: parentScan.spec.cascades,
-    generatedBy: cascadingRule.metadata.name,
-    env,
-    scanLabels: cascadingRule.spec.scanLabels === undefined ? {} :
-      mapValues(cascadingRule.spec.scanLabels, value => Mustache.render(value, templateArgs)),
-    scanAnnotations: cascadingRule.spec.scanAnnotations === undefined ? {} :
-      mapValues(cascadingRule.spec.scanAnnotations, value => Mustache.render(value, templateArgs)),
-    finding
-  };
+  const { scanSpec, scanAnnotations, scanLabels } = cascadingRule.spec;
+  const { scanType, parameters } = scanSpec;
+
+  cascadingRule.spec.scanSpec.scanType =
+    Mustache.render(scanType, templateArgs);
+  cascadingRule.spec.scanSpec.parameters =
+    parameters.map(parameter => Mustache.render(parameter, templateArgs))
+  cascadingRule.spec.scanAnnotations =
+    scanAnnotations === undefined ? {} :mapValues(scanAnnotations, value => Mustache.render(value, templateArgs))
+  cascadingRule.spec.scanLabels =
+    scanLabels === undefined ? {} : mapValues(scanLabels, value => Mustache.render(value, templateArgs))
+
+  return cascadingRule;
 }
 
 function generateCascadingScanName(

diff --git a/hooks/cascading-scans/hook/scan-helpers.ts b/hooks/cascading-scans/hook/scan-helpers.ts
@@ -8,6 +8,8 @@ import {
   generateSelectorString,
   LabelSelector
 } from "./kubernetes-label-selector";
+import {isEqual} from "lodash";
+import {getScanChain} from "./hook";
 
 // configure k8s client
 const kc = new k8s.KubeConfig();
@@ -57,105 +59,32 @@ export interface ScanSpec {
   parameters: Array<string>;
   cascades: LabelSelector & CascadingInheritance;
   env?: Array<k8s.V1EnvVar>;
+  volumes?: Array<k8s.V1Volume>;
+  volumeMounts?: Array<k8s.V1VolumeMount>;
 }
 
 export interface CascadingInheritance {
   inheritLabels: boolean,
-  inheritAnnotations: boolean
+  inheritAnnotations: boolean,
+  inheritEnv: boolean,
+  inheritVolumes: boolean
 }
 
-export interface ExtendedScanSpec extends ScanSpec {
-  // This is the name of the scan. Its not "really" part of the scan spec
-  // But this makes the object smaller
-  name: string;
-
-  // Indicates which CascadingRule was used to generate the resulting Scan
-  generatedBy: string;
-
-  // Additional label to be added to the resulting scan
-  scanLabels: {
-    [key: string]: string;
-  };
-
-  // Additional annotations to be added to the resulting scan
-  scanAnnotations: {
-    [key: string]: string;
-  };
-
-  // Finding that triggered the scan
-  finding: Finding
-}
-
-export function getCascadingScanDefinition({
-   name,
-   scanType,
-   parameters,
-   generatedBy,
-   env,
-   cascades,
-   scanLabels,
-   scanAnnotations,
-   finding
- }: ExtendedScanSpec, parentScan: Scan) {
-  function mergeInherited(parentProps, ruleProps, inherit: boolean = true) {
-    if (!inherit) {
-      parentProps = {};
-    }
-    return {
-      ...parentProps,
-      ...ruleProps // ruleProps overwrites any duplicate keys from parentProps
-    }
+export function mergeInheritedMap(parentProps, ruleProps, inherit: boolean = true) {
+  if (!inherit) {
+    parentProps = {};
   }
-
-  let annotations = mergeInherited(
-    parentScan.metadata.annotations, scanAnnotations, parentScan.spec.cascades.inheritAnnotations);
-  let labels = mergeInherited(
-    parentScan.metadata.labels, scanLabels, parentScan.spec.cascades.inheritLabels);
-
-  let cascadingChain: Array<string> = [];
-
-  if (parentScan.metadata.annotations && parentScan.metadata.annotations["cascading.securecodebox.io/chain"]) {
-    cascadingChain = parentScan.metadata.annotations[
-      "cascading.securecodebox.io/chain"
-    ].split(",");
+  return {
+    ...parentProps,
+    ...ruleProps // ruleProps overwrites any duplicate keys from parentProps
   }
+}
 
-  return {
-    apiVersion: "execution.securecodebox.io/v1",
-    kind: "Scan",
-    metadata: {
-      generateName: `${name}-`,
-      labels: {
-        ...labels
-      },
-      annotations: {
-        "securecodebox.io/hook": "cascading-scans",
-        "cascading.securecodebox.io/parent-scan": parentScan.metadata.name,
-        "cascading.securecodebox.io/matched-finding": finding.id,
-        "cascading.securecodebox.io/chain": [
-          ...cascadingChain,
-          generatedBy
-        ].join(","),
-        ...annotations,
-      },
-      ownerReferences: [
-        {
-          apiVersion: "execution.securecodebox.io/v1",
-          blockOwnerDeletion: true,
-          controller: true,
-          kind: "Scan",
-          name: parentScan.metadata.name,
-          uid: parentScan.metadata.uid
-        }
-      ]
-    },
-    spec: {
-      scanType,
-      parameters,
-      cascades,
-      env,
-    }
-  };
+export function mergeInheritedArray(parentArray, ruleArray, inherit: boolean = false) {
+  if (!inherit) {
+    parentArray = [];
+  }
+  return (parentArray || []).concat(ruleArray)  // CascadingRule's env overwrites scan's env
 }
 
 export async function startSubsequentSecureCodeBoxScan(scan: Scan) {
@@ -209,3 +138,57 @@ export async function getCascadingRulesForScan(scan: Scan) {
     process.exit(1);
   }
 }
+
+// To ensure that the environment variables and volumes from the cascading rule are only applied to the matched scan
+// (and not its children), this function purges the cascading rule spec from the parent scan when inheriting them.
+export function purgeCascadedRuleFromScan(scan: Scan, cascadedRuleUsedForParentScan?: CascadingRule) : Scan {
+  // If there was no cascading rule applied to the parent scan, then ignore no purging is necessary.
+  if (cascadedRuleUsedForParentScan === undefined) return scan;
+
+  if (scan.spec.env !== undefined && cascadedRuleUsedForParentScan.spec.scanSpec.env !== undefined) {
+    scan.spec.env = scan.spec.env.filter(scanEnv =>
+      !cascadedRuleUsedForParentScan.spec.scanSpec.env.some(ruleEnv => isEqual(scanEnv, ruleEnv))
+    );
+  }
+
+  if (scan.spec.volumes !== undefined && cascadedRuleUsedForParentScan.spec.scanSpec.volumes !== undefined) {
+    scan.spec.volumes = scan.spec.volumes.filter(scanVolume =>
+      !cascadedRuleUsedForParentScan.spec.scanSpec.volumes.some(ruleVolume => isEqual(scanVolume, ruleVolume))
+    );
+  }
+
+  if (scan.spec.volumeMounts !== undefined && cascadedRuleUsedForParentScan.spec.scanSpec.volumeMounts !== undefined) {
+    scan.spec.volumeMounts = scan.spec.volumeMounts.filter(scanVolumeMount =>
+      !cascadedRuleUsedForParentScan.spec.scanSpec.volumeMounts.some(ruleVolumeMount => isEqual(scanVolumeMount, ruleVolumeMount))
+    );
+  }
+
+  return scan
+}
+
+export async function getCascadedRuleForScan(scan: Scan) {
+  const chain = getScanChain(scan)
+
+  if (chain.length === 0) return undefined;
+
+  return <CascadingRule> await getCascadingRule(chain[chain.length - 1]);
+}
+
+async function getCascadingRule(ruleName) {
+  try {
+    const response: any = await k8sApiCRD.getNamespacedCustomObject(
+      "cascading.securecodebox.io",
+      "v1",
+      namespace,
+      "cascadingrules",
+      ruleName
+    );
+
+    console.log(`Fetched CascadingRule "${ruleName}" that triggered parent scan`);
+    return response.body;
+  } catch (err) {
+    console.error(`Failed to get CascadingRule "${ruleName}" from the kubernetes api`);
+    console.error(err);
+    process.exit(1);
+  }
+}