aquasecurity / aquasecurity/cloudsploit
[s3Encryption.js]TypeError: glob pattern string required
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
Thanks for the CloudSploit project.
I found out that some of the policy patterns for S3 buckets cause errors in the s3Encryption plugin.
## Error Log
```
/opt/cloudsploit/node_modules/minimatch/minimatch.js:94
throw new TypeError('glob pattern string required')
^
TypeError: glob pattern string required
at minimatch (/opt/cloudsploit/node_modules/minimatch/minimatch.js:94:11)
at statementTargetsAction (/opt/cloudsploit/plugins/aws/s3/s3Encryption.js:16:11)
at getEncryptionLevel (/opt/cloudsploit/plugins/aws/s3/s3Encryption.js:26:17)
at /opt/cloudsploit/plugins/aws/s3/s3Encryption.js:132:41
at Array.map ()
at Object.run (/opt/cloudsploit/plugins/aws/s3/s3Encryption.js:131:66)
at /opt/cloudsploit/engine.js:112:20
at /opt/cloudsploit/node_modules/async/dist/async.js:3682:9
at replenish (/opt/cloudsploit/node_modules/async/dist/async.js:1011:17)
at iterateeCallback (/opt/cloudsploit/node_modules/async/dist/async.js:995:17)
```
## error bucket policy pattern
- "Effect": "Deny"
- "Principal": "*"
- "Action": none
### bucket policy example
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyNotActionSample",
"Effect": "Deny",
"Principal": "*",
"NotAction": "s3:ListBucket",
"Resource": "arn:aws:s3:::your-bucket"
}
]
}
```
Contributor guide
Research direction
Start in plugins/aws/s3/s3Encryption.js at statementTargetsAction (line 16) and follow its use from getEncryptionLevel. Reproduce the failure with the provided bucket policy containing NotAction, then verify the s3Encryption plugin processes that policy without the minimatch TypeError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100