Avoid attempting to clean data from tfvars
Fixes:
MODIFY
checkov/terraform/parser.py
checkov/terraform/parser.py
@@ -209,9 +209,10 @@ class Parser:
continue
var_value_and_file_map[key[7:]] = value, f"env:{key}"
if hcl_tfvars: # terraform.tfvars
- data = _load_or_die_quietly(hcl_tfvars, self.out_parsing_errors)
+ data = _load_or_die_quietly(hcl_tfvars, self.out_parsing_errors,
+ clean_definitions=False)
if data:
- var_value_and_file_map.update({k: (v[0], hcl_tfvars.path) for k, v in data.items()})
+ var_value_and_file_map.update({k: (_safe_index(v, 0), hcl_tfvars.path) for k, v in data.items()})
if json_tfvars: # terraform.tfvars.json
data = _load_or_die_quietly(json_tfvars, self.out_parsing_errors)
if data:
@@ -706,7 +707,8 @@ def _handle_indexing(reference: str, data_source: Callable[[str], Optional[Any]]
return data_source(reference)
-def _load_or_die_quietly(file: os.PathLike, parsing_errors: Dict) -> Optional[Mapping]:
+def _load_or_die_quietly(file: os.PathLike, parsing_errors: Dict,
+ clean_definitions: bool = True) -> Optional[Mapping]:
"""
Load JSON or HCL, depending on filename.
:return: None if the file can't be loaded
@@ -720,7 +722,11 @@ Load JSON or HCL, depending on filename.
if file_name.endswith(".json"):
return json.load(f)
else:
- return _clean_bad_definitions(hcl2.load(f))
+ raw_data = hcl2.load(f)
+ if clean_definitions:
+ return _clean_bad_definitions(raw_data)
+ else:
+ return raw_data
except Exception as e:
LOGGER.debug(f'failed while parsing file {file}', exc_info=e)
parsing_errors[file_path] = e
@@ -777,3 +783,12 @@ def _remove_module_dependency_in_path(path):
if re.findall(resolved_module_pattern, path):
path = re.sub(resolved_module_pattern, '', path)
return path
+
+
+def _safe_index(sequence_hopefully, index) -> Optional[Any]:
+ try:
+ return sequence_hopefully[index]
+ except IndexError as e:
+ logging.debug(f'Failed to parse index int ({index}) out of {sequence_hopefully}')
+ logging.debug(e, stack_info=True)
+ return None

MODIFY
tests/terraform/parser/resources/parser_scenarios/tfvars/expected.json
tests/terraform/parser/resources/parser_scenarios/tfvars/expected.json
"variable": [
{
"foo": {}
+ },
+ {
+ "list_data": {}
+ },
+ {
+ "map_data": {}
}
],
"resource": [

MODIFY
tests/terraform/parser/resources/parser_scenarios/tfvars/main.tf
tests/terraform/parser/resources/parser_scenarios/tfvars/main.tf
variable "foo" {}
+variable "list_data" {}
+variable "map_data" {}
resource "aws_s3_bucket" "my_bucket" {
+ // TODO: List/map isn't resolving correctly
+// bucket = "${var.foo}-${var.list_data[0]}-${var.map_data[stage]}"
bucket = var.foo
}
\ No newline at end of file

Avoid attempting to clean data from tfvars

Fixes: #868