Error when executing custom query for KICS

[gabrielvachon]

Hi,

I'm trying to write some custom ARM queries in KICS just to understand the creation steps. I followed the official documentation about creating queries and I tried to do a really minimalistic function.

query.rego :

package Cx

running_exposed_vms[result] {
    input.document[i].resources[j].type == "Microsoft.Compute/virtualMachines"
    input.document[i].resources[j].properties.securityRules[l].properties.access == "Allow"
    input.document[i].resources[j].properties.securityRules[l].properties.destinationPortRange == "22"

    result := {
        "documentId": input.document[i].id,
        "searchKey": "Testing",
        "issueType": "Testing",
        "keyExpectedValue": "Testing",
        "keyActualValue": "Testing",
        }
}

metadata.json :

{
    "id": "2f4ce417-d7bd-41d2-9294-d1ab7d04ba29",
    "queryName": "Test query",
    "severity": "INFO",
    "category": "Networking and Firewall",
    "descriptionText": "testing",
    "descriptionUrl": "N/A",
    "platform": "AzureResourceManager",
    "descriptionID": "2f4ce417",
    "cloudProvider": "azure"
  }

I also have test folder which has one positive and one negative.

Here is the result after running kics.exe scan -p ..\automation_test\templates\ --report-formats json -o ..\automation_test\ --output-name ARMReport.json -q ..\queries :

Files scanned: 5
Parsed files: 5
Queries loaded: 1
Queries failed to execute: 1

        - test_query:
panic: runtime error: slice bounds out of range [:5] with capacity 3

goroutine 1 [running]:
github.com/Checkmarx/kics/pkg/printer.WordWrap({0x24da6e5, 0x11}, {0x24b2188, 0x2}, 0x5)
        C:/Users/gvachon/Documents/kics/kics/pkg/printer/printer.go:94 +0x17c
github.com/Checkmarx/kics/pkg/printer.PrintResult(0xfe58000, 0xf36c580, 0xec426c0, 0x1)
        C:/Users/gvachon/Documents/kics/kics/pkg/printer/printer.go:114 +0x388
github.com/Checkmarx/kics/pkg/scan.(*Client).resolveOutputs(0xf0537d0, 0xfe58000, {{0xfe600d8, 0x5, 0x5}}, 0xf36c580, 0xec426c0, {0x0})
        C:/Users/gvachon/Documents/kics/kics/pkg/scan/post_scan.go:60 +0x9b
github.com/Checkmarx/kics/pkg/scan.(*Client).postScan(0xf0537d0, 0xf052000)
        C:/Users/gvachon/Documents/kics/kics/pkg/scan/post_scan.go:122 +0x2d4
github.com/Checkmarx/kics/pkg/scan.(*Client).PerformScan(0xf0537d0, {0x2b02660, 0xec46198})
        C:/Users/gvachon/Documents/kics/kics/pkg/scan/client.go:93 +0xa2
github.com/Checkmarx/kics/internal/console.executeScan(0xf7b8b60)
        C:/Users/gvachon/Documents/kics/kics/internal/console/scan.go:163 +0x15e
github.com/Checkmarx/kics/internal/console.run(0xf523c80)
        C:/Users/gvachon/Documents/kics/kics/internal/console/scan.go:98 +0x2f1
github.com/Checkmarx/kics/internal/console.NewScanCmd.func2(0xf523c80, {0xf0f9310, 0x0, 0xa})
        C:/Users/gvachon/Documents/kics/kics/internal/console/scan.go:43 +0x21
github.com/spf13/cobra.(*Command).execute(0xf523c80, {0xf0f9270, 0xa, 0xa})
        C:/Users/gvachon/Documents/kics/kics/vendor/github.com/spf13/cobra/command.go:916 +0x7e6
github.com/spf13/cobra.(*Command).ExecuteC(0xf523b00)
        C:/Users/gvachon/Documents/kics/kics/vendor/github.com/spf13/cobra/command.go:1044 +0x412
github.com/spf13/cobra.(*Command).Execute(...)
        C:/Users/gvachon/Documents/kics/kics/vendor/github.com/spf13/cobra/command.go:968
github.com/spf13/cobra.(*Command).ExecuteContext(...)
        C:/Users/gvachon/Documents/kics/kics/vendor/github.com/spf13/cobra/command.go:961
github.com/Checkmarx/kics/internal/console.Execute()
        C:/Users/gvachon/Documents/kics/kics/internal/console/kics.go:90 +0xc1
main.main()
        C:/Users/gvachon/Documents/kics/kics/cmd/console/main.go:12 +0x1a

I am not sure what is happening here and I am unable to find documentation elsewhere about this issue. What could be the problem here?

Also, really not sure about this command make test, I do not know where "make" comes from. I haven't done it, so could that be the issue?

Thanks!

[cxMiguelSilva]

Hi @gabrielvachon,
I was able to reproduce the panic error and was able to solve it by changing the policy name to CxPolicy instead of running_exposed_vms
The make test executes the go tests. The scripts that are executed with the make command are defined in the makefile.

Hope I was able to help 😃
Let us know in case you need anything else.

[gabrielvachon]

Yes it helped, the query works now, thank you! And thanks for the other clarifications!

[kaplanlior]

Cool. Would you be interested in contributing that query back to KICS ?

[gabrielvachon]

It's been a week now and i came back on making my query work. KICS recognize the query but I realized that the report doesn't show any results, however my rego query works. What could be wrong here?

[cxMiguelSilva]

Does KICS throw any errors? use the -v in the scan to KICS to set the logs to verbose.
Feel free to send us your fork with the query to verify what could be wrong.

[gabrielvachon]

Found the problem, it was just in the REGO query, there was just some rules that were not well defined