fix(terraform): ensure consistent path handling across OS (aquasecuri…

…ty#6161)
AnaisUrlichs · Feb 21, 2024 · 327cf88 · 327cf88
1 parent 8221473
commit 327cf88
Show file tree

Hide file tree

Showing 4 changed files with 17 additions and 14 deletions.
diff --git a/pkg/iac/scanners/terraform/parser/load_module.go b/pkg/iac/scanners/terraform/parser/load_module.go
@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io/fs"
-	"path/filepath"
+	"path"
 	"strings"
 
 	"github.com/zclconf/go-cty/cty"
@@ -112,7 +112,7 @@ func (e *evaluator) loadModuleFromTerraformCache(ctx context.Context, b *terrafo
 		name := b.ModuleName()
 		for _, module := range e.moduleMetadata.Modules {
 			if module.Key == name {
-				modulePath = filepath.Clean(filepath.Join(e.projectRootPath, module.Dir))
+				modulePath = path.Clean(path.Join(e.projectRootPath, module.Dir))
 				break
 			}
 		}
@@ -162,19 +162,19 @@ func (e *evaluator) loadExternalModule(ctx context.Context, b *terraform.Block,
 		SkipCache:       e.skipCachedModules,
 	}
 
-	filesystem, prefix, path, err := resolveModule(ctx, e.filesystem, opt)
+	filesystem, prefix, downloadPath, err := resolveModule(ctx, e.filesystem, opt)
 	if err != nil {
 		return nil, err
 	}
-	prefix = filepath.Join(e.parentParser.moduleSource, prefix)
-	e.debug.Log("Module '%s' resolved to path '%s' in filesystem '%s' with prefix '%s'", b.FullName(), path, filesystem, prefix)
-	moduleParser := e.parentParser.newModuleParser(filesystem, prefix, path, b.Label(), b)
-	if err := moduleParser.ParseFS(ctx, path); err != nil {
+	prefix = path.Join(e.parentParser.moduleSource, prefix)
+	e.debug.Log("Module '%s' resolved to path '%s' in filesystem '%s' with prefix '%s'", b.FullName(), downloadPath, filesystem, prefix)
+	moduleParser := e.parentParser.newModuleParser(filesystem, prefix, downloadPath, b.Label(), b)
+	if err := moduleParser.ParseFS(ctx, downloadPath); err != nil {
 		return nil, err
 	}
 	return &ModuleDefinition{
 		Name:       b.Label(),
-		Path:       path,
+		Path:       downloadPath,
 		Definition: b,
 		Parser:     moduleParser,
 		FileSystem: filesystem,

diff --git a/pkg/iac/scanners/terraform/parser/parser.go b/pkg/iac/scanners/terraform/parser/parser.go
@@ -5,6 +5,7 @@ import (
 	"io"
 	"io/fs"
 	"os"
+	"path"
 	"path/filepath"
 	"sort"
 	"strings"
@@ -164,7 +165,7 @@ func (p *Parser) ParseFile(_ context.Context, fullPath string) error {
 		return err
 	}
 	p.metrics.Timings.DiskIODuration += time.Since(diskStart)
-	if dir := filepath.Dir(fullPath); p.projectRoot == "" {
+	if dir := path.Dir(fullPath); p.projectRoot == "" {
 		p.debug.Log("Setting project/module root to '%s'", dir)
 		p.projectRoot = dir
 		p.modulePath = dir
@@ -195,7 +196,7 @@ func (p *Parser) ParseFile(_ context.Context, fullPath string) error {
 // ParseFS parses a root module, where it exists at the root of the provided filesystem
 func (p *Parser) ParseFS(ctx context.Context, dir string) error {
 
-	dir = filepath.Clean(dir)
+	dir = path.Clean(dir)
 
 	if p.projectRoot == "" {
 		p.debug.Log("Setting project/module root to '%s'", dir)
@@ -212,7 +213,7 @@ func (p *Parser) ParseFS(ctx context.Context, dir string) error {
 
 	var paths []string
 	for _, info := range fileInfos {
-		realPath := filepath.Join(dir, info.Name())
+		realPath := path.Join(dir, info.Name())
 		if info.Type()&os.ModeSymlink != 0 {
 			extra, ok := p.moduleFS.(extrafs.FS)
 			if !ok {

diff --git a/pkg/iac/scanners/terraform/parser/resolvers/local.go b/pkg/iac/scanners/terraform/parser/resolvers/local.go
@@ -3,6 +3,7 @@ package resolvers
 import (
 	"context"
 	"io/fs"
+	"path"
 	"path/filepath"
 )
 
@@ -14,13 +15,13 @@ func (r *localResolver) Resolve(_ context.Context, target fs.FS, opt Options) (f
 	if !opt.hasPrefix(".", "..") {
 		return nil, "", "", false, nil
 	}
-	joined := filepath.Clean(filepath.Join(opt.ModulePath, opt.Source))
+	joined := path.Clean(path.Join(opt.ModulePath, opt.Source))
 	if _, err := fs.Stat(target, filepath.ToSlash(joined)); err == nil {
 		opt.Debug("Module '%s' resolved locally to %s", opt.Name, joined)
 		return target, "", joined, true, nil
 	}
 
-	clean := filepath.Clean(opt.Source)
+	clean := path.Clean(opt.Source)
 	opt.Debug("Module '%s' resolved locally to %s", opt.Name, clean)
 	return target, "", clean, true, nil
 }
diff --git a/pkg/iac/scanners/terraform/scanner.go b/pkg/iac/scanners/terraform/scanner.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"io"
 	"io/fs"
+	"path"
 	"path/filepath"
 	"sort"
 	"strings"
@@ -334,7 +335,7 @@ func (s *Scanner) findRootModules(target fs.FS, scanDir string, dirs ...string)
 			continue
 		}
 		for _, file := range files {
-			realPath := filepath.Join(dir, file.Name())
+			realPath := path.Join(dir, file.Name())
 			if symFS, ok := target.(extrafs.ReadLinkFS); ok {
 				realPath, err = symFS.ResolveSymlink(realPath, scanDir)
 				if err != nil {