diff --git a/policy/resolver.go b/policy/resolver.go index 1ffce002..e06abea0 100644 --- a/policy/resolver.go +++ b/policy/resolver.go @@ -977,6 +977,9 @@ func (cache *policyResolverCache) addCheckJob(ctx context.Context, check *explor cache.global.reportingJobsByUUID[uuid] = queryJob cache.global.reportingJobsByMsum[check.Checksum] = append(cache.global.reportingJobsByMsum[check.Checksum], queryJob) cache.childJobsByMrn[check.Mrn] = append(cache.childJobsByMrn[check.Mrn], queryJob) + } + + if ownerJob.ChildJobs[queryJob.Uuid] == nil { ownerJob.ChildJobs[queryJob.Uuid] = impact } diff --git a/policy/scan/local_scanner_test.go b/policy/scan/local_scanner_test.go index 536934c9..fa9ea7f7 100644 --- a/policy/scan/local_scanner_test.go +++ b/policy/scan/local_scanner_test.go @@ -149,6 +149,49 @@ func (s *LocalScannerSuite) BeforeTest(suiteName, testName string) { } } +func (s *LocalScannerSuite) TestRunIncognito_SharedQuery() { + bundle, err := policy.BundleFromPaths("./testdata/shared-query.mql.yaml") + s.Require().NoError(err) + + _, err = bundle.CompileExt(context.Background(), policy.BundleCompileConf{ + Schema: s.schema, + RemoveFailing: true, + }) + s.Require().NoError(err) + + s.job.Bundle = bundle + bundleMap := bundle.ToMap() + + ctx := context.Background() + scanner := NewLocalScanner() + res, err := scanner.RunIncognito(ctx, s.job) + s.Require().NoError(err) + s.Require().NotNil(res) + + full := res.GetFull() + s.Require().NotNil(full) + + s.Equal(1, len(full.Reports)) + + for k, r := range full.Reports { + // Verify the score is 100 + s.Equal(uint32(100), r.GetScore().Value) + + p := full.ResolvedPolicies[k] + + // Get the code id for all the executed queries + executedQueries := []string{} + for qCodeId := range p.ExecutionJob.Queries { + executedQueries = append(executedQueries, qCodeId) + } + + expectedQueries := []string{ + bundleMap.Queries["//local.cnspec.io/run/local-execution/queries/sshd-01"].CodeId, + } + s.ElementsMatch(expectedQueries, executedQueries) + } +} + func (s *LocalScannerSuite) TestRunIncognito_ExceptionGroups() { bundle, err := policy.BundleFromPaths("./testdata/exception-groups.mql.yaml") s.Require().NoError(err) diff --git a/policy/scan/testdata/shared-query.mql.yaml b/policy/scan/testdata/shared-query.mql.yaml new file mode 100644 index 00000000..4750ee77 --- /dev/null +++ b/policy/scan/testdata/shared-query.mql.yaml @@ -0,0 +1,20 @@ +policies: + - uid: example1 + name: Example policy 1 + version: "1.0.0" + groups: + - filters: true == true + checks: + - uid: sshd-01 + - uid: example2 + name: Example policy 2 + version: "1.0.0" + groups: + - filters: true == true + checks: + - uid: sshd-01 + +queries: + - uid: sshd-01 + title: Ensure the port is set to 22 + mql: true == true \ No newline at end of file