Merge branch 'master' into nik-length-fn

pkg/scanners/cloudformation/parser/fn_condition.go

@@ -0,0 +1,21 @@
+package parser
+
+func ResolveCondition(property *Property) (resolved *Property, success bool) {
+	if !property.isFunction() {
+		return property, true
+	}
+
+	refProp := property.AsMap()["Condition"]
+	if refProp.IsNotString() {
+		return nil, false
+	}
+	refValue := refProp.AsString()
+
+	for k, prop := range property.ctx.Conditions {
+		if k == refValue {
+			return prop.resolveValue()
+		}
+	}
+
+	return nil, false
+}

pkg/scanners/cloudformation/parser/fn_condition_test.go

@@ -0,0 +1,98 @@
+package parser
+
+import (
+	"testing"
+
+	"github.com/aquasecurity/defsec/pkg/scanners/cloudformation/cftypes"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_resolve_condition_value(t *testing.T) {
+
+	fctx := new(FileContext)
+	fctx.Conditions = map[string]Property{
+		"SomeCondition": {
+			ctx: fctx,
+			Inner: PropertyInner{
+				Type: cftypes.Map,
+				Value: map[string]*Property{
+					"Fn::Equals": {
+						ctx: fctx,
+						Inner: PropertyInner{
+							Type: cftypes.List,
+							Value: []*Property{
+								{
+									Inner: PropertyInner{
+										Type:  cftypes.String,
+										Value: "some val",
+									},
+								},
+								{
+									Inner: PropertyInner{
+										Type:  cftypes.String,
+										Value: "some val",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		"EnableVersioning": {
+			ctx: fctx,
+			Inner: PropertyInner{
+				Type: cftypes.Map,
+				Value: map[string]*Property{
+					"Condition": {
+						Inner: PropertyInner{
+							Type:  cftypes.String,
+							Value: "SomeCondition",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	property := &Property{
+		ctx: fctx,
+		Inner: PropertyInner{
+			Type: cftypes.Map,
+			Value: map[string]*Property{
+				"Fn::If": {
+					ctx: fctx,
+					Inner: PropertyInner{
+						Type: cftypes.List,
+						Value: []*Property{
+							{
+								Inner: PropertyInner{
+									Type:  cftypes.String,
+									Value: "EnableVersioning",
+								},
+							},
+							{
+								Inner: PropertyInner{
+									Type:  cftypes.String,
+									Value: "Enabled",
+								},
+							},
+							{
+								Inner: PropertyInner{
+									Type:  cftypes.String,
+									Value: "Suspended",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	resolvedProperty, success := ResolveIntrinsicFunc(property)
+	require.True(t, success)
+
+	assert.Equal(t, "Enabled", resolvedProperty.AsString())
+}

pkg/scanners/cloudformation/parser/intrinsics.go

@@ -28,6 +28,7 @@ func init() {
 		"Fn::Or":          ResolveOr,
 		"Fn::Not":         ResolveNot,
 		"Fn::Length":      ResolveLength,
+		"Condition":       ResolveCondition,
 	}
 }
 
@@ -46,7 +47,7 @@ func IsIntrinsicFunc(node *yaml.Node) bool {
 	}
 
 	nodeTag := strings.TrimPrefix(node.Tag, "!")
-	if nodeTag != "Ref" {
+	if nodeTag != "Ref" && nodeTag != "Condition" {
 		nodeTag = fmt.Sprintf("Fn::%s", nodeTag)
 	}
 	for tag := range intrinsicFuncs {