feat(general): add cortex:skip for suppressions (#6908)

* add cortex:skip * add test
bridgecrewio · Dec 16, 2024 · fa69bcf · fa69bcf
1 parent 602b306
commit fa69bcf
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 2 deletions.
diff --git a/checkov/common/comment/enum.py b/checkov/common/comment/enum.py
@@ -1,3 +1,3 @@
 import re
 
-COMMENT_REGEX = re.compile(r'(checkov:skip=|bridgecrew:skip=) *([A-Za-z_\d]+(?:,[A-Za-z_\d]+)*)?(:[^\n]*)?')
+COMMENT_REGEX = re.compile(r'(checkov:skip=|bridgecrew:skip=|cortex:skip=) *([A-Za-z_\d]+(?:,[A-Za-z_\d]+)*)?(:[^\n]*)?')
diff --git a/checkov/terraform/context_parsers/base_parser.py b/checkov/terraform/context_parsers/base_parser.py
@@ -85,7 +85,7 @@ def _read_file_lines(self) -> List[Tuple[int, str]]:
 
     @staticmethod
     def is_optional_comment_line(line: str) -> bool:
-        return "checkov:skip=" in line or "bridgecrew:skip=" in line
+        return "checkov:skip=" in line or "bridgecrew:skip=" in line or "cortex:skip=" in line
 
     def _collect_skip_comments(self, definition_blocks: List[Dict[str, Any]]) -> Dict[str, Any]:
         """

diff --git a/tests/common/utils/test_utils.py b/tests/common/utils/test_utils.py
@@ -64,6 +64,9 @@ def test_skip_comment_regex(self):
         self.assertIsNotNone(re.search(COMMENT_REGEX, 'bridgecrew:skip=BC_AWS_GENERAL_123'))
         self.assertIsNotNone(re.search(COMMENT_REGEX, 'bridgecrew:skip=bcorg_AWS_1234567'))
         self.assertIsNotNone(re.search(COMMENT_REGEX, 'checkov:skip=bcorg_AWS_1234567'))
+        self.assertIsNotNone(re.search(COMMENT_REGEX, 'cortex:skip=CKV_AWS_145: ADD REASON'))
+        self.assertIsNotNone(re.search(COMMENT_REGEX, 'cortex:skip=CKV_AWS_145:ADD REASON'))
+        self.assertIsNotNone(re.search(COMMENT_REGEX, 'cortex:skip=CKV_AWS_145'))