unmarshal exact - ensuring the config does not contain invalid values

[svyotov]

Description:

Fixes #811. This PR tries to ensure if there are extra invalid values in the git config to fail and not continue silently. Uses viper.UnmarshalExact which uses mapstructure.

UnmarshalExact unmarshals the config into a Struct, erroring if a field is nonexistent in the destination struct.

Checklist:

• Does your PR pass tests?
• Have you written new tests for your changes?
• Have you lint your code locally prior to submission?

[svyotov]

@zricethezav Please take a look at this PR, merging it should be straight forwards, and makes configuration much easier, because end users will know when they put invalid/unsupported keys in the config file. Thank you!

[svyotov]

@zricethezav any thoughts for this PR, thank you?

[zricethezav]

@svyotov going to take a look at this soon. Sorry for the delay

[svyotov]

Hello @zricethezav! Do you have a verdict for this PR, will it be useful or should we close it?

[zricethezav]

@svyotov I think I agree with these changes. UnmarshalExact will only throw an error if an extraneous or incorrect entry is discovered, not if one is missing right? For example, most of the rules do not contain path entries

[svyotov]

@svyotov I think I agree with these changes. UnmarshalExact will only throw an error if an extraneous or incorrect entry is discovered, not if one is missing right? For example, most of the rules do not contain path entries

I believe so, and also the tests indicate so (error when there was an extra key) and none of the old unit tests failed (some of them must be missing keys).

unmarshalWantError: &mapstructure.Error{Errors: []string{"'Rules[0]' has invalid keys: fake_key"}},

[jit-ci]

❌ Jit has detected 2 important findings in this PR that you should review.
The findings are detailed below as separate comments.
It’s highly recommended that you fix these security issues before merge.

[jit-ci]

Security control: Secret Detection

Type: Aws-Access-Token

Description: AWS

Severity: HIGH

---

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

• #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
• #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
• #jit_undo_ignore Undo ignore command

[svyotov]

#jit_ignore_fp

[jit-ci]

Security control: Secret Detection

Type: Aws-Access-Token

Description: AWS

Severity: HIGH

---

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

• #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
• #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
• #jit_undo_ignore Undo ignore command

[svyotov]

#jit_ignore_fp

[svyotov]

Hello, I have re-based, added a test for missing keys, and made a change to the previous test to work with the new schema.
I did it fast, so please be thorough when reviewing. Thank you.

[svyotov]

@zricethezav please let me know if I need to do anything about the current failures in the CI. I do want to help get this in - if it is useful.

[svyotov]

To be clear though, this will be a breaking change, as anyone having invalid values in their config - values which up to now where ignored - will get errors from the tool, so the version change for this release should be minor /major and not patch.

[svyotov]

closing this due to lack of interest/response.