Fixups to check logic after review changes.
MODIFY
checkov/circleci_pipelines/checks/ReverseShellNetcat.py
checkov/circleci_pipelines/checks/ReverseShellNetcat.py
@@ -26,6 +26,10 @@ class ReverseShellNetcat(BaseCircleCIPipelinesCheck):
command = run.get("command", "")
if re.search(r'(nc|netcat) (\d{1,3}).(\d{1,3}).(\d{1,3}).(\d{1,3})', command):
return CheckResult.FAILED, conf
+ else:
+ if re.search(r'(nc|netcat) (\d{1,3}).(\d{1,3}).(\d{1,3}).(\d{1,3})', run):
+ return CheckResult.FAILED, conf
+
return CheckResult.PASSED, conf

MODIFY
checkov/circleci_pipelines/checks/ShellInjection.py
checkov/circleci_pipelines/checks/ShellInjection.py
@@ -29,6 +29,7 @@ class DontAllowShellInjection(BaseCircleCIPipelinesCheck):
if re.search(term, command):
return CheckResult.FAILED, conf
+ else:
for term in bad_inputs:
if re.search(term, run):
return CheckResult.FAILED, conf

MODIFY
checkov/circleci_pipelines/checks/prevent_volatile_orbs.py
checkov/circleci_pipelines/checks/prevent_volatile_orbs.py
@@ -17,18 +17,14 @@ class PreventVolatileOrbs(BaseCircleCIPipelinesCheck):
)
def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]:
- badOrbInBlock = False
- for orb in conf:
- if type(conf[orb]) == str:
+ for orb in conf.values():
+ if isinstance(orb, str):
# Special __ vars show up in this dict too.
- if "@volatile" in conf[orb]:
- badOrbInBlock = True
- # We only get one return per orb: section, regardless of how many orbs, so set a flag and error later.
+ if "@volitile" in orb:
+ # We only get one return per orb: section, regardless of how many orbs.
# Potentially more JMEpath reflection-foo can resolve this so we end up with a call to scan_entity_conf per orb.
-
- if badOrbInBlock:
return CheckResult.FAILED, conf
- else:
+
return CheckResult.PASSED, conf
check = PreventVolatileOrbs()

Fixups to check logic after review changes.