Error when executing custom query for KICS #6462

gabrielvachon · 2023-06-20T14:48:53Z

gabrielvachon
Jun 20, 2023

Hi,

I'm trying to write some custom ARM queries in KICS just to understand the creation steps. I followed the official documentation about creating queries and I tried to do a really minimalistic function.

query.rego :

package Cx

running_exposed_vms[result] {
    input.document[i].resources[j].type == "Microsoft.Compute/virtualMachines"
    input.document[i].resources[j].properties.securityRules[l].properties.access == "Allow"
    input.document[i].resources[j].properties.securityRules[l].properties.destinationPortRange == "22"

    result := {
        "documentId": input.document[i].id,
        "searchKey": "Testing",
        "issueType": "Testing",
        "keyExpectedValue": "Testing",
        "keyActualValue": "Testing",
        }
}

metadata.json :

{
    "id": "2f4ce417-d7bd-41d2-9294-d1ab7d04ba29",
    "queryName": "Test query",
    "severity": "INFO",
    "category": "Networking and Firewall",
    "descriptionText": "testing",
    "descriptionUrl": "N/A",
    "platform": "AzureResourceManager",
    "descriptionID": "2f4ce417",
    "cloudProvider": "azure"
  }

I also have test folder which has one positive and one negative.

Here is the result after running kics.exe scan -p ..\automation_test\templates\ --report-formats json -o ..\automation_test\ --output-name ARMReport.json -q ..\queries :

Files scanned: 5
Parsed files: 5
Queries loaded: 1
Queries failed to execute: 1

        - test_query:
panic: runtime error: slice bounds out of range [:5] with capacity 3

goroutine 1 [running]:
github.com/Checkmarx/kics/pkg/printer.WordWrap({0x24da6e5, 0x11}, {0x24b2188, 0x2}, 0x5)
        C:/Users/gvachon/Documents/kics/kics/pkg/printer/printer.go:94 +0x17c
github.com/Checkmarx/kics/pkg/printer.PrintResult(0xfe58000, 0xf36c580, 0xec426c0, 0x1)
        C:/Users/gvachon/Documents/kics/kics/pkg/printer/printer.go:114 +0x388
github.com/Checkmarx/kics/pkg/scan.(*Client).resolveOutputs(0xf0537d0, 0xfe58000, {{0xfe600d8, 0x5, 0x5}}, 0xf36c580, 0xec426c0, {0x0})
        C:/Users/gvachon/Documents/kics/kics/pkg/scan/post_scan.go:60 +0x9b
github.com/Checkmarx/kics/pkg/scan.(*Client).postScan(0xf0537d0, 0xf052000)
        C:/Users/gvachon/Documents/kics/kics/pkg/scan/post_scan.go:122 +0x2d4
github.com/Checkmarx/kics/pkg/scan.(*Client).PerformScan(0xf0537d0, {0x2b02660, 0xec46198})
        C:/Users/gvachon/Documents/kics/kics/pkg/scan/client.go:93 +0xa2
github.com/Checkmarx/kics/internal/console.executeScan(0xf7b8b60)
        C:/Users/gvachon/Documents/kics/kics/internal/console/scan.go:163 +0x15e
github.com/Checkmarx/kics/internal/console.run(0xf523c80)
        C:/Users/gvachon/Documents/kics/kics/internal/console/scan.go:98 +0x2f1
github.com/Checkmarx/kics/internal/console.NewScanCmd.func2(0xf523c80, {0xf0f9310, 0x0, 0xa})
        C:/Users/gvachon/Documents/kics/kics/internal/console/scan.go:43 +0x21
github.com/spf13/cobra.(*Command).execute(0xf523c80, {0xf0f9270, 0xa, 0xa})
        C:/Users/gvachon/Documents/kics/kics/vendor/github.com/spf13/cobra/command.go:916 +0x7e6
github.com/spf13/cobra.(*Command).ExecuteC(0xf523b00)
        C:/Users/gvachon/Documents/kics/kics/vendor/github.com/spf13/cobra/command.go:1044 +0x412
github.com/spf13/cobra.(*Command).Execute(...)
        C:/Users/gvachon/Documents/kics/kics/vendor/github.com/spf13/cobra/command.go:968
github.com/spf13/cobra.(*Command).ExecuteContext(...)
        C:/Users/gvachon/Documents/kics/kics/vendor/github.com/spf13/cobra/command.go:961
github.com/Checkmarx/kics/internal/console.Execute()
        C:/Users/gvachon/Documents/kics/kics/internal/console/kics.go:90 +0xc1
main.main()
        C:/Users/gvachon/Documents/kics/kics/cmd/console/main.go:12 +0x1a

I am not sure what is happening here and I am unable to find documentation elsewhere about this issue. What could be the problem here?

Also, really not sure about this command make test, I do not know where "make" comes from. I haven't done it, so could that be the issue?

Thanks!

Answered by cxMiguelSilva

Jun 21, 2023

Hi @gabrielvachon,
I was able to reproduce the panic error and was able to solve it by changing the policy name to CxPolicy instead of running_exposed_vms
The make test executes the go tests. The scripts that are executed with the make command are defined in the makefile.

Hope I was able to help 😃
Let us know in case you need anything else.

View full answer

cxMiguelSilva · 2023-06-21T10:53:06Z

cxMiguelSilva
Jun 21, 2023
Maintainer

Hi @gabrielvachon,
I was able to reproduce the panic error and was able to solve it by changing the policy name to CxPolicy instead of running_exposed_vms
The make test executes the go tests. The scripts that are executed with the make command are defined in the makefile.

Hope I was able to help 😃
Let us know in case you need anything else.

2 replies

gabrielvachon Jun 21, 2023
Author

Yes it helped, the query works now, thank you! And thanks for the other clarifications!

kaplanlior Jun 21, 2023

Cool. Would you be interested in contributing that query back to KICS ?

gabrielvachon · 2023-06-27T14:17:23Z

gabrielvachon
Jun 27, 2023
Author

It's been a week now and i came back on making my query work. KICS recognize the query but I realized that the report doesn't show any results, however my rego query works. What could be wrong here?

2 replies

cxMiguelSilva Jun 27, 2023
Maintainer

Does KICS throw any errors? use the -v in the scan to KICS to set the logs to verbose.
Feel free to send us your fork with the query to verify what could be wrong.

gabrielvachon Jun 27, 2023
Author

Found the problem, it was just in the REGO query, there was just some rules that were not well defined

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Error when executing custom query for KICS #6462

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 4 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Error when executing custom query for KICS #6462

gabrielvachon Jun 20, 2023

Replies: 2 comments · 4 replies

cxMiguelSilva Jun 21, 2023 Maintainer

gabrielvachon Jun 21, 2023 Author

kaplanlior Jun 21, 2023

gabrielvachon Jun 27, 2023 Author

cxMiguelSilva Jun 27, 2023 Maintainer

gabrielvachon Jun 27, 2023 Author

gabrielvachon
Jun 20, 2023

Replies: 2 comments 4 replies

cxMiguelSilva
Jun 21, 2023
Maintainer

gabrielvachon Jun 21, 2023
Author

gabrielvachon
Jun 27, 2023
Author

cxMiguelSilva Jun 27, 2023
Maintainer

gabrielvachon Jun 27, 2023
Author