feat: support exclude expiry in config

docs/guides/configuration/config.md

@@ -106,6 +106,24 @@ exclude:
   - aws-s3-enable-versioning
 ```
 
+Excludes can include an expiry date, after which the check will be re-enabled.
+
+```json
+{
+  "exclude": ["CUS002:2022-12-31", "aws-s3-enable-versioning"]
+}
+```
+
+or in yaml
+
+
+```yaml
+---
+exclude:
+  - CUS002:2022-12-31
+  - aws-s3-enable-versioning
+```
+
 ### Minimum required version
 
 For your CI you might want to pull a config file into all of your build processes with a centrally managed config file. If this is the case, you might also want to require a minimum tfsec version to be used.

internal/app/tfsec/cmd/flags.go

@@ -288,8 +288,8 @@ func applyConfigFiles(options []options.ScannerOption, dir string) ([]options.Sc
 			if len(conf.IncludedChecks) > 0 {
 				options = append(options, scanner.ScannerWithIncludedRules(conf.IncludedChecks))
 			}
-			if len(conf.ExcludedChecks) > 0 {
-				options = append(options, scanner.ScannerWithExcludedRules(append(conf.ExcludedChecks, excludedRuleIDs)))
+			if len(conf.GetValidExcludedChecks()) > 0 {
+				options = append(options, scanner.ScannerWithExcludedRules(append(conf.GetValidExcludedChecks(), excludedRuleIDs)))
 			}
 			if len(conf.ExcludeIgnores) > 0 {
 				options = append(options, scanner.ScannerWithExcludeIgnores(append(conf.ExcludeIgnores, excludeIgnoresIDs)))

internal/pkg/config/config.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/aquasecurity/defsec/pkg/severity"
 	"gopkg.in/yaml.v2"
@@ -54,6 +55,25 @@ func LoadConfig(configFilePath string) (*Config, error) {
 	return config, nil
 }
 
+func (c *Config) GetValidExcludedChecks() (excludedChecks []string) {
+	for _, check := range c.ExcludedChecks {
+		if strings.Contains(check, ":") {
+			parts := strings.Split(check, ":")
+			if len(parts) == 2 {
+				if expiry, err := time.Parse("2006-01-02", parts[1]); err == nil {
+					if expiry.Before(time.Now()) {
+						continue
+					}
+				}
+			}
+			excludedChecks = append(excludedChecks, parts[0])
+		} else {
+			excludedChecks = append(excludedChecks, check)
+		}
+	}
+	return excludedChecks
+}
+
 func rewriteSeverityOverrides(config *Config) {
 	for k, s := range config.SeverityOverrides {
 		config.SeverityOverrides[k] = string(severity.StringToSeverity(s))

internal/pkg/config/config_test.go

@@ -44,7 +44,44 @@ exclude_ignores:
 	c := load(t, "config.yaml", content)
 
 	assert.Contains(t, c.SeverityOverrides, "AWS018")
-	assert.Contains(t, c.ExcludedChecks, "DP001")
+	assert.Contains(t, c.GetValidExcludedChecks(), "DP001")
+	assert.Contains(t, c.ExcludeIgnores, "DP002")
+}
+
+func TestExpiredExcludesElementsFromYAMLNotPresent(t *testing.T) {
+	content := `
+severity_overrides:
+  AWS018: LOW
+
+exclude:
+  - DP001:2021-01-01
+
+exclude_ignores:
+  - DP002
+`
+	c := load(t, "config.yaml", content)
+
+	assert.Contains(t, c.SeverityOverrides, "AWS018")
+	assert.Len(t, c.GetValidExcludedChecks(), 0)
+	assert.Contains(t, c.ExcludeIgnores, "DP002")
+}
+
+func TestExcludesElementsFromYAMLWithFutureExpiryIsPresent(t *testing.T) {
+	content := `
+severity_overrides:
+  AWS018: LOW
+
+exclude:
+  - DP001:3099-01-01
+
+exclude_ignores:
+  - DP002
+`
+	c := load(t, "config.yaml", content)
+
+	assert.Contains(t, c.SeverityOverrides, "AWS018")
+	assert.Len(t, c.GetValidExcludedChecks(), 1)
+	assert.Contains(t, c.GetValidExcludedChecks(), "DP001")
 	assert.Contains(t, c.ExcludeIgnores, "DP002")
 }
 
@@ -62,7 +99,7 @@ exclude_ignores:
 	c := load(t, "config.yml", content)
 
 	assert.Contains(t, c.SeverityOverrides, "AWS018")
-	assert.Contains(t, c.ExcludedChecks, "DP001")
+	assert.Contains(t, c.GetValidExcludedChecks(), "DP001")
 	assert.Contains(t, c.ExcludeIgnores, "DP002")
 }
 
@@ -82,7 +119,7 @@ func TestExcludesElementsFromJSON(t *testing.T) {
 	c := load(t, "config.json", content)
 
 	assert.Contains(t, c.SeverityOverrides, "AWS018")
-	assert.Contains(t, c.ExcludedChecks, "DP001")
+	assert.Contains(t, c.GetValidExcludedChecks(), "DP001")
 	assert.Contains(t, c.ExcludeIgnores, "DP002")
 }