elastic / elastic/cloudbeat

[BUG] Policies CLI args parser doesn't support single dash flags

Open
#692 0 comments 1 reaction 0 assignees View on GitHub
bug cloudbeat Team:Cloud Security triaged
Dominant language
Go
Stars
58
Forks
55
Avg merge
9h 9m
Merged PRs (30d)
424

Description

**Describe the bug**
In the [csp-security-policies](https://github.com/elastic/csp-security-policies/) repository, we parse processes in order to validate the existence or absence of certain flags. Currently, we only support flags that start with `--` where other flags can break the entire behavior.
For example: `someProcess --someFlag value -singleDashFlag` will be parsed as
```
"--someFlag": "value -singleDashFlag"
```
The source of it lies in our process parser module where we build a key-value **map** of arguments where instead we should have built an arguments **list** as it represents better the way processes work.

Our process parser is composed of two components that depend on each other:
1. It always starts by parsing the arguments into a CLI map
2. Then an audit can use the map to validate that a certain key aligns with a rule conditions

**Suggested solutions**
- We should consider implementing that logic as a rego builtin that uses some go library to parse CLI args
- Write a rego parser that uses a list instead of a map and reimplement the way we assert for a key-value (as list is less intuitive for that matter)

**Definition of done**
- [ ] Make sure `someProcess --someFlag value -singleDashFlag` is parsed properly.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.