Skip to content

fix(query): fn for Cloudformation queries - complete boolean logic update#7585

Merged
cx-andre-pereira merged 9 commits into
Checkmarx:masterfrom
cx-andre-pereira:AST-40783--FN_CloudFormation_Boolean_Logic_Update--cloudformation/aws
Aug 6, 2025
Merged

fix(query): fn for Cloudformation queries - complete boolean logic update#7585
cx-andre-pereira merged 9 commits into
Checkmarx:masterfrom
cx-andre-pereira:AST-40783--FN_CloudFormation_Boolean_Logic_Update--cloudformation/aws

Conversation

@cx-andre-pereira

Copy link
Copy Markdown
Contributor

Reason for Proposed Changes

  • Currently all Cloudformation queries only allow for true or false , with no quotes, as valid values for scanned files. This is too strict because Cloudformation allows "true" and "false" string values, even within single quotes ('true'). In facto Cloudformation does not support an explicit "Boolean" type, false/true will always be read as strings regardless.
  • Given this there was a need for a overhaul of a lot of queries that check for true/false Boolean values to allow for a comprehensive query logic.

Proposed Changes

  • Inclusion of a new cloudformation library function isCloudFormationTrue, similar to the already implemented , but unused in most relevant queries,isCloudFormationFalse function. This isCloudFormationFalse function was already in use for a few queries but there was never a rundown of them to adjust all other instances of bool comparison.
  • Replacement of all == true and == false comparisons within every query to now make use of the relevant auxiliar functions.
  • Inclusion of new tests for every query affected to guarantee correct interpretation of true/false strings.
  • Reduced size of a few overly complex samples for simpler payload and expected results analysis.
  • Re-factor of some "expected-results" files to follow expected standard.

I submit this contribution under the Apache-2.0 license.

@cx-andre-pereira cx-andre-pereira requested a review from a team as a code owner July 24, 2025 15:56
@github-actions github-actions Bot added query New query feature cloudformation CloudFormation query aws PR related with AWS Cloud labels Jul 24, 2025
@Checkmarx Checkmarx deleted a comment from gitguardian Bot Jul 24, 2025
@Checkmarx Checkmarx deleted a comment from gitguardian Bot Jul 24, 2025
@gitguardian

gitguardian Bot commented Aug 6, 2025

Copy link
Copy Markdown

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

Since your pull request originates from a forked repository, GitGuardian is not able to associate the secrets uncovered with secret incidents on your GitGuardian dashboard.
Skipping this check run and merging your pull request will create secret incidents on your GitGuardian dashboard.

🔎 Detected hardcoded secret in your pull request
GitGuardian id GitGuardian status Secret Commit Filename
19562607 Triggered Generic Password 5cbea1a assets/queries/common/passwords_and_secrets/test/positive53.json View secret
🛠 Guidelines to remediate hardcoded secrets
  1. Understand the implications of revoking this secret by investigating where it is used in your code.
  2. Replace and store your secret safely. Learn here the best practices.
  3. Revoke and rotate this secret.
  4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider


🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

@cx-artur-ribeiro cx-artur-ribeiro left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, nice addition of new test cases with the string/boolean cases!

@cx-andre-pereira cx-andre-pereira merged commit 34d4909 into Checkmarx:master Aug 6, 2025
27 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aws PR related with AWS Cloud cloudformation CloudFormation query query New query feature

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants