fix(output): honor include-actions for data exfiltration findings - #625
Open
nitrocode wants to merge 1 commit into
Open
fix(output): honor include-actions for data exfiltration findings#625nitrocode wants to merge 1 commit into
nitrocode wants to merge 1 commit into
Conversation
The Data Exfiltration finding category only checked the hardcoded READ_ONLY_DATA_EXFILTRATION_ACTIONS list, so actions added via include-actions in an exclusions file had no effect on this category, even though other finding categories (e.g. Infrastructure Modification) already respect include-actions. Union include-actions into the set of actions checked for data exfiltration, so custom actions opted in via the exclusions config are flagged consistently across finding categories. Fixes salesforce#624
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
DataExfiltrationfinding category only checks actions against thehardcoded
READ_ONLY_DATA_EXFILTRATION_ACTIONSlist. Actions added viainclude-actionsin an exclusions file have no effect on this category,even though other finding categories (e.g. Infrastructure Modification)
already respect
include-actions.Repro
include-actions: [s3:ListBucket]s3:ListBucketonResource: "*"with no conditions3:ListBucketappears underDataExfiltration.findingsFix
Union
include-actionsinto the set of actions checked byPolicyFinding.data_exfiltration, so custom actions opted in via theexclusions config are flagged consistently with how other finding
categories already treat
include-actions.Added a regression test covering both the include-actions and
no-include-actions cases.
Note: this is a behavior change for anyone already using
include-actionstoday, they may see new DataExfiltration findings that were previously
silently missed.
Fixes #624