fix rule shadows builtin lint issue in .rego queries

Checkmarx · Feb 24, 2025 · 4a7a327 · 4a7a327
1 parent 3da838e
commit 4a7a327
Show file tree

Hide file tree

Showing 7 changed files with 10 additions and 21 deletions.
diff --git a/assets/queries/ansible/aws/alb_listening_on_http/query.rego b/assets/queries/ansible/aws/alb_listening_on_http/query.rego
@@ -2,10 +2,7 @@ package Cx
 
 import data.generic.ansible as ansLib
 
-modules := {
-"community.aws.elb_application_lb",
-"elb_application_lb"
-}
+modules := {"community.aws.elb_application_lb","elb_application_lb"}
 
 CxPolicy[result] {
 	task := ansLib.tasks[id][t]

diff --git a/assets/queries/cloudFormation/aws/ecs_task_definition_invalid_cpu_or_memory/query.rego b/assets/queries/cloudFormation/aws/ecs_task_definition_invalid_cpu_or_memory/query.rego
@@ -69,10 +69,6 @@ checkMemory(res, memory) {
 	checkRemainder(mem, res.Properties.ContainerDefinitions[_].Cpu)
 }
 
-contains(arr, elem) {
-	arr[_] = elem
-}
-
 checkRemainder(mem, cpu) {
 	not cpu == 256
 	not mem % 1024 == 0

diff --git a/assets/queries/cloudFormation/aws/elasticsearch_logs_disabled/query.rego b/assets/queries/cloudFormation/aws/elasticsearch_logs_disabled/query.rego
@@ -66,7 +66,3 @@ CxPolicy[result] {
 		"searchLine": common_lib.build_search_line(["Resource", name, "Properties"], []),
 	}
 }
-
-contains(array, elem) {
-	array[_] == elem
-} else = false
diff --git a/assets/queries/cloudFormation/aws/elasticsearch_without_slow_logs/query.rego b/assets/queries/cloudFormation/aws/elasticsearch_without_slow_logs/query.rego
@@ -11,7 +11,7 @@ CxPolicy[result] {
 	resource := Resources[name]
 	resource.Type == "AWS::Elasticsearch::Domain"
 	common_lib.valid_key(resource.Properties, "LogPublishingOptions")
-	logs := [logName | contains(slowLogs, logName); log := resource.Properties.LogPublishingOptions[logName]]
+	logs := [logName | array_contains(slowLogs, logName); log := resource.Properties.LogPublishingOptions[logName]]
 	count(logs) == 0
 
 	result := {
@@ -67,6 +67,6 @@ CxPolicy[result] {
 	}
 }
 
-contains(array, elem) {
+array_contains(array, elem) {
 	array[_] == elem
 } else = false
diff --git a/assets/queries/cloudFormation/aws/elb_v2_alb_access_log_disabled/query.rego b/assets/queries/cloudFormation/aws/elb_v2_alb_access_log_disabled/query.rego
@@ -26,7 +26,7 @@ CxPolicy[result] {
 	resource.Type == "AWS::ElasticLoadBalancingV2::LoadBalancer"
 	prop := resource.Properties
 
-	contains(prop.LoadBalancerAttributes, "access_logs.s3.enabled")
+	array_contains(prop.LoadBalancerAttributes, "access_logs.s3.enabled")
 
 	result := {
 		"documentId": input.document[i].id,
@@ -39,7 +39,7 @@ CxPolicy[result] {
 	}
 }
 
-contains(arr, elem) {
+array_contains(arr, elem) {
 	arr[i].Key == elem
 	arr[i].Value == false
 }
diff --git a/assets/queries/dockerfile/healthcheck_instruction_missing/query.rego b/assets/queries/dockerfile/healthcheck_instruction_missing/query.rego
@@ -6,7 +6,7 @@ CxPolicy[result] {
 	resource := input.document[i].command[name]
 	dockerLib.check_multi_stage(name, input.document[i].command)
 
-	not contains(resource, "healthcheck")
+	not cmd_contains(resource, "healthcheck")
 
 	result := {
 		"documentId": input.document[i].id,
@@ -17,6 +17,6 @@ CxPolicy[result] {
 	}
 }
 
-contains(cmd, elem) {
+cmd_contains(cmd, elem) {
 	cmd[_].Cmd = elem
 }
diff --git a/assets/queries/k8s/incorrect_volume_claim_access_mode_read_write_once/query.rego b/assets/queries/k8s/incorrect_volume_claim_access_mode_read_write_once/query.rego
@@ -7,7 +7,7 @@ CxPolicy[result] {
 
 	volumeClaims := document.spec.volumeClaimTemplates
 
-	vClaimsWitReadWriteOnce := [vClaims | contains(volumeClaims[v].spec.accessModes, "ReadWriteOnce") == true; vClaims := volumeClaims[v].metadata.name]
+	vClaimsWitReadWriteOnce := [vClaims | array_contains(volumeClaims[v].spec.accessModes, "ReadWriteOnce") == true; vClaims := volumeClaims[v].metadata.name]
 	count(vClaimsWitReadWriteOnce) == 0
 
 	metadata := document.metadata
@@ -30,7 +30,7 @@ CxPolicy[result] {
 
 	volumeClaims := document.spec.volumeClaimTemplates
 
-	vClaimsWitReadWriteOnce := [vClaims | contains(volumeClaims[v].spec.accessModes, "ReadWriteOnce") == true; vClaims := volumeClaims[v].metadata.name]
+	vClaimsWitReadWriteOnce := [vClaims | array_contains(volumeClaims[v].spec.accessModes, "ReadWriteOnce") == true; vClaims := volumeClaims[v].metadata.name]
 	count(vClaimsWitReadWriteOnce) > 1
 
 	metadata := document.metadata
@@ -46,6 +46,6 @@ CxPolicy[result] {
 	}
 }
 
-contains(array, string) {
+array_contains(array, string) {
 	array[_] == string
 }