fix(general): check both path types for suppression (#5834)

* check both path types for suppression * add test for when CWD is outside of repo structure
bridgecrewio · Dec 6, 2023 · aa609aa · aa609aa
1 parent 7dd27f1
commit aa609aa
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 1 deletion.
diff --git a/checkov/common/bridgecrew/integration_features/features/suppressions_integration.py b/checkov/common/bridgecrew/integration_features/features/suppressions_integration.py
@@ -13,6 +13,7 @@
 from checkov.common.bridgecrew.platform_integration import bc_integration
 from checkov.common.models.enums import CheckResult
 from checkov.common.output.record import SCA_PACKAGE_SCAN_CHECK_NAME
+from checkov.common.util.file_utils import convert_to_unix_path
 
 if TYPE_CHECKING:
     from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration
@@ -140,7 +141,8 @@ def _check_suppression(self, record: Record, suppression: dict[str, Any]) -> boo
         elif type == 'Resources':
             for resource in suppression['resources']:
                 if self.bc_integration.repo_matches(resource['accountId']) \
-                        and resource['resourceId'] == f'{record.repo_file_path}:{record.resource}':
+                        and (resource['resourceId'] == f'{record.repo_file_path}:{record.resource}'
+                             or resource['resourceId'] == f'{convert_to_unix_path(record.file_path)}:{record.resource}'):
                     return True
             return False
         elif type == 'Tags':

diff --git a/tests/common/integration_features/test_suppressions_integration.py b/tests/common/integration_features/test_suppressions_integration.py
@@ -882,9 +882,28 @@ def test_resource_suppression(self):
                          check_class=None, file_abs_path='.', entity_tags=None)
         record3.repo_file_path = '/terraform/aws/s3.tf'
 
+        # cases for when the CWD of the process is outside the repo
+        record4 = Record(check_id='CKV_AWS_18', check_name=None, check_result=None,
+                         code_block=None, file_path=None,
+                         file_line_range=None,
+                         resource='aws_s3_bucket.operations', evaluations=None,
+                         check_class=None, file_abs_path='.', entity_tags=None)
+        record4.file_path = '/terraform/aws/s3.tf'
+        record4.repo_file_path = '/some/abs/path/to/terraform/aws/s3.tf'
+
+        record5 = Record(check_id='CKV_AWS_18', check_name=None, check_result=None,
+                         code_block=None, file_path=None,
+                         file_line_range=None,
+                         resource='aws_s3_bucket.operations', evaluations=None,
+                         check_class=None, file_abs_path='.', entity_tags=None)
+        record5.file_path = '\\terraform\\aws\\s3.tf'
+        record5.repo_file_path = '/some/abs/path/to/terraform/aws/s3.tf'
+
         self.assertTrue(suppressions_integration._check_suppression(record1, suppression))
         self.assertFalse(suppressions_integration._check_suppression(record2, suppression))
         self.assertFalse(suppressions_integration._check_suppression(record3, suppression))
+        self.assertTrue(suppressions_integration._check_suppression(record4, suppression))
+        self.assertTrue(suppressions_integration._check_suppression(record5, suppression))
 
     def test_resource_suppression_cli_repo(self):
         instance = BcPlatformIntegration()