Azure / ShieldGuard

Enables best security practices for your project from day zero.
MIT License
8 stars 6 forks source link

feat: implement support for using anchor in policies list #29

Closed bcho closed 1 year ago

bcho commented 1 year ago

This pull request implements support for using yaml anchor in the file settings. Now we can define and reuse policies list like this:

common-policies-list: &common-policies-list
  ? ./policy-1
  ? ./policy-2

another-shared-policies-list: &another-shared-policies-list
  ? ./policy-3
  ? ./policy-4

files:
 - name: target
   paths:
    - ./path
   policies:
     << : [*common-policies-list, *another-shared-policies-list]
     ? ./policy-5

This config would be resolved as:

{
  "files": [
    {
      "paths": ["./path"],
      "policies": { "./policy-1": null, "./policy-2": null, "./policy-3": null, "./policy-4": null, "./policy-5": null  }
    }
  ]
}

Since the policies list can be either string list (["./policy-1", "./policy-2"]) or a map ({"./policy-1": null, "./policy-2": null}), we implement a new internal data structure to support both type in a single field.

everjing commented 1 year ago

This pull request implements support for using yaml anchor in the file settings. Now we can define and reuse policies list like this:

common-policies-list: &common-policies-list
  ? ./policy-1
  ? ./policy-2

another-shared-policies-list: &another-shared-policies-list
  ? ./policy-3
  ? ./policy-4

files:
 - name: target
   paths:
    - ./path
   policies:
     << : [*common-policies-list, *another-shared-policies-list]
     ? ./policy-5

This config would be resolved as:

{
  "files": [
    {
      "paths": ["./path"],
      "policies": { "./policy-1": null, "./policy-2": null, "./policy-3": null, "./policy-4": null, "./policy-5": null  }
    }
  ]
}

Since the policies list can be either string list (["./policy-1", "./policy-2"]) or a map ({"./policy-1": null, "./policy-2": null}), we implement a new internal data structure to support both type in a single field.

I think <<: is overridden instead of adding. So in this case you replaced both lists with ?./policy-5 and the results will be as below?

{
  "files": [
    {
      "paths": ["./path"],
      "policies": { "./policy-5": null, "./policy-5": null  }
    }
  ]
}
bcho commented 1 year ago

<<: means merging in yaml (ref: https://yaml.org/type/merge.html)

It's equivalent to this:

image

https://jsonformatter.org/yaml-formatter